CVE-2024-47068: Rollupjs Rollup XSS Vulnerability

CVE-2024-47068 Overview

CVE-2024-47068 is a DOM Clobbering vulnerability affecting Rollup, a popular JavaScript module bundler. The vulnerability exists in how Rollup handles scripts utilizing properties from import.meta (such as import.meta.url) when bundling in cjs, umd, or iife output formats. This flaw can be exploited as a gadget to achieve cross-site scripting (XSS) attacks on web pages where attacker-controlled HTML elements are present without proper sanitization.

Critical Impact
This DOM Clobbering vulnerability enables attackers to execute arbitrary JavaScript in victim browsers through XSS when unsanitized HTML elements (e.g., an img tag with a malicious name attribute) exist on the target page.

Affected Products

Rollup versions prior to 2.79.2
Rollup versions 3.x prior to 3.29.5
Rollup versions 4.x prior to 4.22.4

Discovery Timeline

September 23, 2024 - CVE-2024-47068 published to NVD
October 29, 2024 - Last updated in NVD database

Technical Details for CVE-2024-47068

Vulnerability Analysis

The vulnerability resides in the MetaProperty.ts file within Rollup's AST node processing logic. When Rollup bundles JavaScript modules that reference import.meta properties and outputs them in CommonJS (cjs), Universal Module Definition (umd), or Immediately Invoked Function Expression (iife) formats, it generates code that references document.currentScript.src to resolve the script's URL.

The original implementation lacked proper validation to ensure that document.currentScript actually referred to a legitimate <script> element. This oversight creates a DOM Clobbering vulnerability where an attacker can inject HTML elements with specific name or id attributes that override the expected DOM property references, effectively hijacking the script resolution mechanism to inject malicious content.

Root Cause

The root cause is insufficient validation of DOM element types when accessing document.currentScript. The vulnerable code blindly trusted that document.currentScript would return a <script> element without verifying its tagName property. In browsers, DOM Clobbering allows named HTML elements to be accessed as properties of document, enabling attackers to substitute expected DOM references with malicious elements.

Attack Vector

The attack requires the following conditions:

A web application uses Rollup-bundled JavaScript in cjs, umd, or iife format
The bundled code accesses import.meta properties (e.g., import.meta.url)
The page contains attacker-controlled HTML elements without proper sanitization (e.g., through user-generated content)

An attacker can inject an HTML element such as <img name="currentScript" src="javascript:alert('XSS')"> which overrides document.currentScript, causing the bundled code to use the attacker's malicious element instead of the legitimate script reference, leading to XSS execution.

typescript

// Vulnerable code before patch (from MetaProperty.ts)
// The code accessed document.currentScript.src without type validation
getResolveUrl(
    `'${escapeId(relativePath)}', ${
        umd ? `typeof document === 'undefined' ? location.href : ` : ''
    }document.currentScript && document.currentScript.src || document.baseURI`
);

// Patched code adds tagName validation to prevent DOM Clobbering
getResolveUrl(
    `'${escapeId(relativePath)}', ${
        umd ? `typeof document === 'undefined' ? location.href : ` : ''
    }document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`
);

Source: GitHub Commit - Fix DOM Clobbering CVE

Detection Methods for CVE-2024-47068

Indicators of Compromise

Presence of suspicious HTML elements with name or id attributes matching DOM global properties (e.g., name="currentScript")
Unexpected XSS payload execution originating from Rollup-bundled script contexts
Anomalous DOM manipulation activity in browser developer console logs

Detection Strategies

Audit Rollup version in package.json and package-lock.json files to identify vulnerable versions (<2.79.2, <3.29.5 for 3.x, or <4.22.4 for 4.x)
Implement Content Security Policy (CSP) headers with strict script-src directives to detect and block unauthorized script execution
Monitor for DOM Clobbering patterns in user-submitted HTML content through input validation logging
Use static analysis tools to scan bundled JavaScript for vulnerable import.meta usage patterns in cjs/umd/iife outputs

Monitoring Recommendations

Enable browser-based XSS auditing and CSP violation reporting to capture exploitation attempts
Monitor dependency update notifications from npm audit or Snyk for Rollup package vulnerabilities
Implement runtime integrity checks for critical DOM properties in production applications

How to Mitigate CVE-2024-47068

Immediate Actions Required

Upgrade Rollup to patched versions: 2.79.2, 3.29.5, or 4.22.4 depending on your major version branch
Audit existing applications for user-generated content that may contain unsanitized HTML elements
Implement strict HTML sanitization for all user input to prevent DOM Clobbering attack vectors
Review CSP headers to ensure restrictive script-src policies are in place

Patch Information

The Rollup maintainers have released security patches in versions 2.79.2, 3.29.5, and 4.22.4. The fix adds explicit validation of document.currentScript.tagName to ensure it equals 'SCRIPT' before accessing the src property. Detailed patch information is available in the GitHub Security Advisory.

Workarounds

If immediate upgrade is not possible, switch bundled output format to es modules which don't rely on document.currentScript
Implement server-side HTML sanitization to strip potentially dangerous name and id attributes from user content
Deploy Content Security Policy headers with script-src 'self' to limit XSS impact
Use DOMPurify or similar libraries to sanitize any HTML rendered in the application context

bash

# Update Rollup to patched version
npm update rollup@latest

# Or specify exact patched versions based on your major version
npm install rollup@2.79.2  # For 2.x users
npm install rollup@3.29.5  # For 3.x users  
npm install rollup@4.22.4  # For 4.x users

# Verify installed version
npm list rollup