DOM Clobbering via Mutation XSS in DOMPurify

Executive Summary

This vulnerability is a mutation-based Cross-Site Scripting (XSS) issue in DOMPurify versions before 3.3.2. It occurs when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers craft payloads that escape the wrapper context during reparsing, reactivating harmful markup with event handlers to execute JavaScript.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the DOMPurify version in use. Inspect your project's package.json or dependency files for DOMPurify versions before 3.3.2. Use commands like 'npm list dompurify' or 'yarn list dompurify' to verify installed versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in a user's browser by tricking them into viewing specially crafted HTML. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the user if they interact with the malicious content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable DOMPurify versions may face compliance failures and potential regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DOMPurify to version 3.3.2 or later immediately. Avoid using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript for sanitized HTML. Prefer DOM-safe APIs such as textContent or createElement instead.

Useful 0 Not Useful 0