DOM-based XSS Bypass in DOMPurify via URI Validation

Executive Summary

DOMPurify before version 3.3.2 has a URI validation bypass vulnerability when using the ADD_ATTR feature with EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can provide a predicate function that accepts specific attribute and tag combinations, allowing unsafe protocols like javascript: to bypass sanitization. This can lead to DOM-based cross-site scripting (XSS) when the malicious link is activated.

Useful 0 Not Useful 0

Detection Guidance

Check DOMPurify version with npm list dompurify or grep "version" in package.json. If version is below 3.3.2, the system is vulnerable. Inspect code using ADD_ATTR with EXTRA_ELEMENT_HANDLING.attributeCheck for predicate functions that may bypass URI validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject malicious javascript: URLs that bypass DOMPurify's sanitization. When a user clicks the link, it can execute arbitrary JavaScript code in their browser, potentially stealing data, session cookies, or performing actions on their behalf.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable DOMPurify versions may face compliance violations and potential fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DOMPurify to version 3.3.2 or later immediately. Remove or review any custom predicate functions in ADD_ATTR that may allow unsafe URI protocols. Monitor network traffic for suspicious javascript: URLs or DOM-based XSS attempts.

Useful 0 Not Useful 0