DOM Purify 3.4.12 XSS via Custom Element Sanitization Bypass

Executive Summary

DOMPurify before version 3.4.12 fails to execute the afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck. This allows sensitive attributes on custom elements to bypass sanitization, enabling second-order XSS attacks when these attributes are later re-injected into innerHTML sinks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of DOMPurify on your system. If you are using a version before 3.4.12, your system is vulnerable. Run commands like 'npm list dompurify' for Node.js projects or inspect the version in your package.json file.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to preserve malicious attributes on custom elements that bypass security policies. When these elements are re-injected into the DOM via innerHTML, they may trigger cross-site scripting (XSS) attacks, compromising user data or session integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to XSS attacks, which may result in unauthorized data access or manipulation. Such breaches could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, potentially leading to legal and compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade DOMPurify to version 3.4.12 or later. If upgrading is not possible, disable the CUSTOM_ELEMENT_HANDLING.tagNameCheck feature or ensure custom elements are properly sanitized through the afterSanitizeElements hook.

Useful 0 Not Useful 0