CVE-2024-21541: Dom-iterator RCE Vulnerability

CVE-2024-21541 Overview

CVE-2024-21541 is an Arbitrary Code Execution vulnerability affecting the dom-iterator npm package prior to version 1.0.1. The vulnerability stems from the unsafe use of JavaScript's Function constructor without proper input sanitization, allowing attackers to inject and execute arbitrary code within applications that process untrusted input through the affected library.

Critical Impact

Applications using vulnerable versions of dom-iterator may allow attackers to execute arbitrary JavaScript code, potentially leading to complete application compromise, data theft, or lateral movement within affected systems.

Affected Products

• matthewmueller dom-iterator versions before 1.0.1
• Node.js applications incorporating vulnerable dom-iterator package
• Java applications using org.webjars.npm dom-iterator WebJar

Discovery Timeline

• 2024-11-13 - CVE-2024-21541 published to NVD
• 2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-21541

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The dom-iterator package, designed for iterating over DOM nodes in JavaScript applications, contains a critical flaw in how it handles dynamic function generation.

The root issue lies in the use of JavaScript's Function constructor to create new function bodies from input parameters. When attacker-controlled data reaches this constructor without adequate sanitization, it enables arbitrary code execution within the application context. This vulnerability pattern shares significant risk characteristics with the well-known dangers of eval() injection.

The impact is particularly concerning for server-side JavaScript applications (Node.js) where code execution could lead to server compromise, though client-side applications are also at risk of cross-site scripting style attacks through this vector.

Root Cause

The vulnerability originates from the Function constructor being invoked with insufficiently sanitized inputs. The Function constructor in JavaScript dynamically compiles and executes code from string arguments, making it extremely dangerous when combined with user-controllable input. The dom-iterator package failed to implement complete input validation before passing data to this constructor, creating an injection point for malicious code.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft malicious input that, when processed by the vulnerable dom-iterator functions, results in the execution of arbitrary JavaScript code.

The attack scenario typically involves:

1. An application using dom-iterator processes external or user-provided data
2. The attacker crafts input containing JavaScript code payloads
3. The unsanitized input reaches the Function constructor
4. The malicious code executes within the application's security context

Successful exploitation could allow attackers to access sensitive data, modify application behavior, establish persistence, or pivot to other systems depending on the application's permissions and network position.

Detection Methods for CVE-2024-21541

Indicators of Compromise

• Unexpected JavaScript execution patterns in application logs
• Unusual network connections originating from Node.js processes
• Anomalous DOM manipulation or iteration behaviors in client-side applications
• Evidence of code injection attempts in input validation logs

Detection Strategies

• Implement Software Composition Analysis (SCA) to identify dom-iterator versions below 1.0.1 in your dependency tree
• Monitor for unusual process spawning from Node.js applications
• Deploy Web Application Firewalls (WAF) with rules to detect code injection patterns
• Review application logs for anomalous function execution or unexpected eval-like behaviors

Monitoring Recommendations

• Enable verbose logging for applications using dom-iterator to capture input processing
• Implement runtime application self-protection (RASP) to detect code injection attempts
• Monitor package.json and lock files for vulnerable dom-iterator versions
• Set up alerts for dependency audit failures in CI/CD pipelines

How to Mitigate CVE-2024-21541

Immediate Actions Required

• Update dom-iterator to version 1.0.1 or later immediately
• Run npm audit or yarn audit to identify vulnerable packages in your projects
• Review applications for any instances where untrusted input may reach dom-iterator functions
• Consider implementing input validation at application boundaries as defense-in-depth

Patch Information

The vulnerability has been addressed in dom-iterator version 1.0.1. The fix is available via the GitHub commit 9e0e0fa which implements proper input sanitization before the Function constructor is invoked.

For additional technical details on this vulnerability, refer to the Snyk JavaScript advisory and the Snyk Java WebJar advisory.

Workarounds

• If immediate patching is not possible, implement strict input validation to reject any data containing JavaScript code constructs before it reaches dom-iterator
• Consider temporarily replacing dom-iterator with alternative DOM traversal methods that don't rely on dynamic function generation
• Deploy Content Security Policy (CSP) headers to limit the impact of potential code execution in browser environments
• Isolate affected applications in sandboxed environments to contain potential compromise

# Update dom-iterator to patched version
npm update dom-iterator@^1.0.1

# Verify installed version
npm list dom-iterator

# Run security audit to confirm fix
npm audit