Cross-Realm XSS Bypass in DOMPurify via IN_PLACE Mode

Executive Summary

DOMPurify through version 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element comes from a different window or realm, such as an iframe's contentDocument. A flawed cross-realm instanceof check causes DOMPurify to incorrectly stringify the element and disable IN_PLACE mode, returning the unsanitized element with XSS payloads intact.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using DOMPurify versions 3.3.3 or earlier in IN_PLACE mode. Check if DOM elements from cross-window contexts (e.g., iframes) are passed to DOMPurify without proper sanitization. Review server logs for unusual string outputs like '[object HTMLDivElement]' in sanitized outputs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows XSS attacks when applications use DOMPurify's IN_PLACE mode with cross-window elements. Attackers could inject malicious scripts that execute in the context of the main document, potentially stealing data or performing unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows XSS payloads to remain intact in unsanitized DOM elements, which could lead to unauthorized data access or manipulation. This may violate GDPR's data protection requirements (e.g., Article 32 security of processing) and HIPAA's safeguards for protected health information if exploited in healthcare applications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DOMPurify to version 3.4.4 or later. Avoid using IN_PLACE mode with cross-window DOM elements. Replace IN_PLACE mode with standard sanitization of HTML strings to prevent XSS payloads from bypassing sanitization.

Useful 0 Not Useful 0