CVE-2024-45801: Tampering by prototype polution in DOMPurify
DOMPurify could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in depth check. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
Other sources
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.
This renders dompurify unable to avoid XSS attack.
Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45801?
CVE-2024-45801 is considered a high severity vulnerability due to its potential for XSS exploitation.
How do I fix CVE-2024-45801?
To fix CVE-2024-45801, update DOMPurify to version 3.1.3 or later, or to version 2.5.4 if using an earlier version.
What is the impact of CVE-2024-45801?
CVE-2024-45801 allows attackers to bypass depth checking, leading to potential XSS attacks.
Who is affected by CVE-2024-45801?
CVE-2024-45801 affects users of DOMPurify versions between 3.0.0 and 3.1.3 and those using versions up to 2.5.4.
What is DOMPurify in relation to CVE-2024-45801?
DOMPurify is an XSS sanitizer for HTML, MathML, and SVG that is affected by CVE-2024-45801 due to a vulnerability in its nesting depth mechanisms.