CVE-2024-48910: Cure53 DOMPurify XSS Vulnerability

CVE-2024-48910 Overview

CVE-2024-48910 is a prototype pollution vulnerability affecting DOMPurify, a widely-used DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. This vulnerability allows attackers to pollute JavaScript object prototypes, potentially leading to arbitrary code execution, denial of service, or security control bypasses in applications relying on DOMPurify for input sanitization.

Critical Impact

This prototype pollution vulnerability in DOMPurify could allow attackers to bypass XSS sanitization controls, inject malicious properties into the JavaScript prototype chain, and potentially achieve remote code execution in affected web applications.

Affected Products

• Cure53 DOMPurify versions prior to 2.4.2

Discovery Timeline

• 2024-10-31 - CVE-2024-48910 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-48910

Vulnerability Analysis

This prototype pollution vulnerability (CWE-1321) exists in DOMPurify's object cloning mechanism. The vulnerability stems from improper validation when iterating over object properties during the sanitization process. An attacker can exploit this flaw to inject properties into JavaScript's base Object.prototype, which then propagates to all objects in the application, potentially bypassing security controls or enabling further attacks.

Prototype pollution is particularly dangerous in XSS sanitizers like DOMPurify because it can undermine the very security guarantees the library is designed to provide. By polluting the prototype chain, attackers may be able to influence sanitization behavior or inject malicious content that would otherwise be filtered.

Root Cause

The root cause of CVE-2024-48910 lies in the object property iteration logic within DOMPurify's codebase. The vulnerable code used a truthy check on the result of hasOwnProperty rather than a strict equality comparison. This allowed specially crafted input to bypass property ownership validation, enabling prototype pollution through inherited properties.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by supplying maliciously crafted input to any application using a vulnerable version of DOMPurify. The crafted payload would contain properties designed to pollute the prototype chain, affecting all JavaScript objects within the application context.

// Security patch showing the fix (Source: GitHub Commit)
   var property;
 
   for (property in object) {
-    if (apply(hasOwnProperty, object, [property])) {
+    if (apply(hasOwnProperty, object, [property]) === true) {
       newObject[property] = object[property];
     }
   }

Source: GitHub Commit Update

The fix changes the truthy check to a strict boolean comparison (=== true), ensuring that only properties where hasOwnProperty explicitly returns true are copied, preventing prototype pollution via manipulated return values.

Detection Methods for CVE-2024-48910

Indicators of Compromise

• Unusual JavaScript errors related to unexpected object properties appearing in application logs
• Anomalous behavior in sanitization routines where previously blocked content passes through
• Detection of __proto__, constructor, or prototype strings in user-supplied input to sanitization functions
• Application crashes or unexpected behavior following user input processing

Detection Strategies

• Implement dependency scanning tools to identify vulnerable DOMPurify versions (prior to 2.4.2) in your codebase
• Deploy Web Application Firewalls (WAF) with rules to detect prototype pollution payloads in HTTP requests
• Use Static Application Security Testing (SAST) tools to identify usage of vulnerable DOMPurify versions
• Monitor npm/yarn audit reports for CVE-2024-48910 advisories in your dependency tree

Monitoring Recommendations

• Enable verbose logging for XSS sanitization operations to detect anomalous sanitization bypass attempts
• Implement runtime monitoring for unexpected modifications to Object.prototype in JavaScript environments
• Set up automated dependency vulnerability scanning in CI/CD pipelines to catch vulnerable versions before deployment
• Monitor application behavior for signs of prototype pollution such as unexpected property access patterns

How to Mitigate CVE-2024-48910

Immediate Actions Required

• Upgrade DOMPurify to version 2.4.2 or later immediately
• Audit all applications and dependencies that include DOMPurify as a direct or transitive dependency
• Review application logs for any evidence of exploitation attempts
• Implement input validation to reject suspicious prototype pollution payloads as a defense-in-depth measure

Patch Information

The vulnerability is fixed in DOMPurify version 2.4.2. The security patch modifies the property iteration logic to use strict boolean comparison when checking property ownership. Organizations should update their DOMPurify dependency to version 2.4.2 or later. The fix is available in the GitHub Commit Update. Additional details are available in the GitHub Security Advisory. Debian users should refer to the Debian LTS Announcement for distribution-specific guidance.

Workarounds

• Freeze Object.prototype using Object.freeze(Object.prototype) before loading untrusted content (may break some applications)
• Implement server-side input validation to strip known prototype pollution payloads before processing
• Use Content Security Policy (CSP) headers to limit the impact of potential XSS if sanitization is bypassed
• Consider implementing additional sanitization layers as defense-in-depth while awaiting patch deployment

# Update DOMPurify to the patched version
npm update dompurify@2.4.2
# Or using yarn
yarn upgrade dompurify@2.4.2
# Verify installed version
npm list dompurify