DOM-based XSS via Prototype Pollution in DOMPurify

Executive Summary

DOMPurify before version 3.3.2 has a prototype pollution vulnerability in USE_PROFILES mode. Attackers can pollute Array.prototype properties like setting onclick to true. This bypasses attribute filtering, causing DOMPurify to accept event handlers as allowlisted attributes. When sanitized markup is rendered, this results in DOM-based XSS.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of DOMPurify. If your system uses versions 3.3.1 or earlier with USE_PROFILES enabled, it is vulnerable. Run: npm list dompurify or grep dompurify package.json to verify the version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject malicious event handlers like onclick into sanitized HTML. When the sanitized content is rendered, these event handlers execute, leading to DOM-based XSS attacks. This can compromise user sessions, steal data, or perform unauthorized actions on behalf of users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations using vulnerable DOMPurify versions may face compliance breaches if exploited, potentially resulting in legal penalties or data breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DOMPurify to version 3.3.2 or later immediately. If upgrading is not possible, disable the USE_PROFILES option in your DOMPurify configuration to prevent prototype pollution attacks.

Useful 0 Not Useful 0