CVE-2024-43788 in Webpack
Summary
by MITRE • 08/27/2024
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/09/2026
Webpack serves as a fundamental module bundler for JavaScript applications, transforming and packaging assets for browser deployment. The vulnerability resides within the AutoPublicPathRuntimeModule component which handles automatic public path detection for webpack-generated bundles. This module contains a DOM Clobbering gadget that creates a dangerous code-reuse attack vector. The flaw specifically manifests when attacker-controlled HTML elements containing unsanitized name attributes are present in web pages that incorporate webpack-generated JavaScript files. The vulnerability enables attackers to manipulate DOM properties through malicious HTML markup, transforming benign elements into executable code vectors that can be exploited by attackers.
The technical implementation of this vulnerability follows the established patterns of DOM Clobbering as defined by CWE-79 and categorized under CWE-787 for out-of-bounds writes. The attack leverages the fact that certain JavaScript properties can be overwritten by DOM elements with matching names, particularly when these elements lack proper sanitization of their name or id attributes. In the Canvas LMS case, this vulnerability was successfully exploited to execute cross-site scripting attacks through webpack-compiled JavaScript code. The attack chain begins with an attacker injecting HTML markup containing elements with specific name attributes, which then interact with the vulnerable webpack runtime module to establish execution contexts that can be leveraged for XSS exploitation. This represents a sophisticated attack pattern that combines client-side code manipulation with server-side build tool vulnerabilities.
The operational impact of this vulnerability extends across any web application using webpack versions prior to 5.94.0 that permit user-generated content containing HTML elements with unsanitized attributes. The vulnerability can be exploited in contexts where users can inject HTML through comments, posts, or other content management features, particularly when these elements contain name or id attributes that match JavaScript properties within webpack's runtime. The attack requires minimal privileges from the attacker since it exploits existing functionality within the webpack build process rather than requiring direct code injection. The vulnerability has been classified under the ATT&CK framework as a code reuse technique (T1073) and falls under the broader category of client-side attack vectors. Organizations using webpack in their build pipelines face significant risk exposure, particularly those with user-generated content features that do not properly sanitize HTML attributes.
The resolution for this vulnerability requires immediate upgrade to webpack version 5.94.0 or later, as no effective workarounds exist for this particular DOM Clobbering issue. Security teams should conduct comprehensive audits of their webpack configurations to identify any potential exposure points where user-generated content might interact with webpack-generated assets. The fix implemented in version 5.94.0 addresses the specific code paths in AutoPublicPathRuntimeModule that enabled the DOM Clobbering attack vector, effectively neutralizing the vulnerability by preventing the dangerous property overwrites that previously enabled XSS exploitation. Organizations should also implement additional defensive measures such as Content Security Policy (CSP) headers to limit the impact of any potential exploitation attempts, though these serve as supplementary protections rather than primary fixes for the underlying vulnerability.