CVE-2020-26870: Cure53 DOMPurify Mutation XSS Vulnerability

CVE-2020-26870 Overview

CVE-2020-26870 is a mutation Cross-Site Scripting (XSS) vulnerability in Cure53 DOMPurify before version 2.0.17. The vulnerability occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, allowing an attacker to exploit namespace changes from HTML to MathML. This behavior can be demonstrated through nesting of FORM elements within SVG or MathML contexts, enabling malicious script execution that bypasses DOMPurify's sanitization filters.

Critical Impact

Attackers can bypass DOMPurify's XSS sanitization through mutation XSS techniques, potentially executing arbitrary JavaScript in victim browsers. This affects multiple enterprise products including Microsoft Visual Studio 2017/2019, Oracle Application Express, and Debian Linux distributions.

Affected Products

• Cure53 DOMPurify (versions before 2.0.17)
• Microsoft Visual Studio 2017 (version 15.9)
• Microsoft Visual Studio 2019 (versions 16.0, 16.4, 16.7, 16.8)
• Oracle Application Express
• Debian Linux 9.0

Discovery Timeline

• 2020-10-07 - CVE-2020-26870 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-26870

Vulnerability Analysis

This mutation XSS vulnerability exploits a fundamental weakness in how DOMPurify sanitizes HTML content. When HTML is parsed, serialized, and re-parsed, the browser's DOM parser may interpret the structure differently than expected. This is particularly problematic when namespace contexts shift between HTML and MathML or SVG. The vulnerability specifically targets the serialize-parse roundtrip behavior where nested FORM elements within mathematical or vector graphics contexts can cause the DOM tree to mutate after sanitization, ultimately executing malicious scripts that were not present in the sanitized output.

The attack exploits the fact that certain HTML elements like <p>, <br>, <form>, and <table> behave differently when nested inside <svg> or <math> elements. When these elements are encountered inside foreign content namespaces, the browser may break out of the foreign namespace context, causing DOM mutations that can reactivate previously sanitized malicious payloads.

Root Cause

The root cause lies in DOMPurify's incomplete handling of elements that trigger namespace breakout behavior. Prior to version 2.0.17, the sanitizer checked for <p>, <br>, and <form> elements within <svg> or <math> contexts but failed to account for <table> elements. This oversight allowed attackers to craft payloads using <table> elements nested within MathML or SVG containers to achieve DOM mutation after the sanitization process completed.

Attack Vector

The attack requires user interaction where a victim must view malicious content that has been processed through the vulnerable DOMPurify version. An attacker crafts specially formatted HTML containing nested FORM or TABLE elements within MathML namespaces. When this content is sanitized by DOMPurify and subsequently rendered in the browser, the serialize-parse roundtrip causes the DOM to mutate, allowing previously neutralized script tags or event handlers to become active.

The network-based attack vector means this can be exploited through any web application that uses DOMPurify for user-supplied content sanitization, including content management systems, forums, email clients, and collaborative editing tools.

/* Take care of an mXSS pattern using p, br inside svg, math */
-    if ((tagName === 'svg' || tagName === 'math') && currentNode.querySelectorAll('p, br, form').length !== 0) {
+    if ((tagName === 'svg' || tagName === 'math') && currentNode.querySelectorAll('p, br, form, table').length !== 0) {
       _forceRemove(currentNode);
       return true;
     }

Source: GitHub Commit 02724b8

Detection Methods for CVE-2020-26870

Indicators of Compromise

• Unusual HTML content containing nested <math> or <svg> elements with embedded <form> or <table> tags
• Web application logs showing attempts to submit content with MathML namespace declarations
• JavaScript errors or unexpected script execution on pages displaying user-generated content
• Content containing encoded or obfuscated MathML payloads in input fields or comment sections

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewalls (WAF) with rules targeting MathML-based XSS patterns
• Monitor client-side JavaScript errors for signs of mutation XSS exploitation attempts
• Audit application dependencies to identify instances of DOMPurify versions prior to 2.0.17

Monitoring Recommendations

• Enable verbose logging for content sanitization operations to track unusual input patterns
• Set up alerts for CSP violation reports indicating blocked inline script execution
• Monitor npm/package manager audit results for outdated DOMPurify versions across all projects
• Review browser console outputs in staging environments for unexpected script execution warnings

How to Mitigate CVE-2020-26870

Immediate Actions Required

• Upgrade DOMPurify to version 2.0.17 or later immediately across all affected applications
• Audit all projects using DOMPurify to identify vulnerable versions using npm audit or equivalent tools
• Implement Content Security Policy headers as a defense-in-depth measure against XSS
• Review and update Microsoft Visual Studio installations through official security updates

Patch Information

The vulnerability has been addressed in DOMPurify version 2.0.17. The fix adds table to the list of elements that trigger forced removal when found within svg or math contexts. Organizations should update to this version or later through their package managers. For detailed changes, refer to the GitHub Version Comparison between versions 2.0.16 and 2.0.17.

Microsoft has released security updates addressing this vulnerability in Visual Studio products through their Microsoft Security Advisory. Oracle has addressed the issue in Application Express through the Oracle July 2021 Security Alert. Debian users should apply updates referenced in the Debian LTS Announcement.

Workarounds

• If immediate patching is not possible, implement server-side HTML sanitization as an additional layer
• Deploy strict Content Security Policy headers that block inline scripts and unsafe-eval
• Consider temporarily disabling user-generated content features until patching can be completed
• Implement input validation to reject content containing <math> or <svg> elements if not required

# Update DOMPurify to patched version
npm update dompurify@^2.0.17

# Verify installed version
npm list dompurify

# Run security audit to identify vulnerable packages
npm audit