cure53 DOMPurify up to 2.5.3/3.1.2 Nesting redos

Summaryinfo

A vulnerability classified as critical was found in cure53 DOMPurify up to 2.5.3/3.1.2. This affects an unknown function of the component Nesting Handler. Executing a manipulation can lead to redos. This vulnerability appears as CVE-2024-45801. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in cure53 DOMPurify up to 2.5.3/3.1.2. It has been declared as critical. This vulnerability affects an unknown function of the component Nesting Handler. The manipulation with an unknown input leads to a redos vulnerability. The CWE definition for the vulnerability is CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-45801 since 09/09/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1449.003.

The vulnerability scanner Nessus provides a plugin with the ID 212033 (RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:10762)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.5.4 or 3.1.3 eliminates this vulnerability. Applying the patch 1e520262bf4c66b5efda49e2316d6d1246ca7b21 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (212033) and CERT Bund (WID-SEC-2024-3250). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Red Hat Enterprise Linux
• Red Hat OpenShift
• Atlassian Bitbucket
• Atlassian Confluence

Productinfo

Vendor

• cure53

Name

• DOMPurify

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 3.1.0
• 3.1.1
• 3.1.2

License

• open-source

Website

• Product: https://github.com/cure53/DOMPurify/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion