CVE-2024-51757: happy-dom RCE Vulnerability

CVE-2024-51757 Overview

CVE-2024-51757 is a critical remote code execution vulnerability in happy-dom, a JavaScript implementation of a web browser without its graphical user interface. This library is commonly used for server-side rendering, testing, and web scraping in Node.js environments. Versions prior to 15.10.2 are susceptible to arbitrary code execution on the host system through malicious script tags embedded in parsed HTML content.

Critical Impact

Attackers can execute arbitrary code on servers running vulnerable versions of happy-dom by injecting malicious script tags, potentially leading to complete system compromise.

Affected Products

• happy-dom versions prior to 15.10.2
• Node.js applications using vulnerable happy-dom versions for server-side rendering
• Testing frameworks utilizing happy-dom for DOM simulation

Discovery Timeline

• 2024-11-06 - CVE-2024-51757 published to NVD
• 2024-11-08 - Last updated in NVD database

Technical Details for CVE-2024-51757

Vulnerability Analysis

This vulnerability exists in the happy-dom library's handling of script tags during HTML parsing and execution. Unlike a traditional browser environment where JavaScript execution is sandboxed, happy-dom runs in the Node.js environment with full access to the host system's resources. When processing untrusted HTML content containing script tags, the library fails to properly sanitize or isolate the script execution context, allowing malicious code to break out of the intended DOM simulation and execute with the privileges of the Node.js process.

The vulnerability is classified as CWE-79 (Cross-Site Scripting), though in this server-side context it manifests as a code injection vector rather than traditional client-side XSS. The network attack vector with no authentication requirements makes this particularly dangerous for applications that process user-supplied HTML content.

Root Cause

The root cause lies in improper input handling within the SyncFetchScriptBuilder.ts module. Specifically, the vulnerability stems from the unsafe construction of JavaScript code using template literals without proper escaping. User-controlled URL data was being directly interpolated into executable code strings, allowing injection of arbitrary JavaScript that would execute in the Node.js context.

Attack Vector

The attack vector involves supplying malicious HTML content containing script tags to an application using a vulnerable version of happy-dom. When the library parses and processes this content, the malicious script executes within the Node.js environment, potentially allowing attackers to:

1. Read sensitive files from the server file system
2. Execute system commands
3. Establish reverse shells for persistent access
4. Exfiltrate environment variables and secrets
5. Pivot to other internal systems

The security patch demonstrates the fix by properly encoding the URL using JSON.stringify() instead of direct template literal interpolation:

// Security patch in packages/happy-dom/src/fetch/utilities/SyncFetchScriptBuilder.ts
                const request = sendRequest(${JSON.stringify(
                    request.url.href
                )}, options, (incomingMessage) => {
                    let data = Buffer.alloc(0);
                    incomingMessage.on('data', (chunk) => {
                        data = Buffer.concat([data, Buffer.from(chunk)]);

Source: GitHub Commit Bug Fix

Detection Methods for CVE-2024-51757

Indicators of Compromise

• Unexpected child processes spawned by Node.js applications using happy-dom
• Unusual network connections originating from server-side rendering processes
• Anomalous file system access patterns from Node.js processes
• Suspicious script tags in application logs containing Node.js-specific APIs (e.g., require, process, child_process)

Detection Strategies

• Audit package.json and package-lock.json files for happy-dom versions below 15.10.2
• Implement runtime monitoring for unexpected module loading (e.g., child_process, fs, net) during HTML parsing
• Use Software Composition Analysis (SCA) tools to identify vulnerable dependencies across your codebase
• Monitor for process execution anomalies in server-side rendering services

Monitoring Recommendations

• Enable verbose logging for applications processing untrusted HTML content
• Implement egress filtering to detect unauthorized outbound connections from rendering services
• Set up alerts for any file system modifications by happy-dom-utilizing processes
• Configure application-level sandboxing using Node.js --experimental-permission flags where possible

How to Mitigate CVE-2024-51757

Immediate Actions Required

• Upgrade happy-dom to version 15.10.2 or later immediately
• Audit all applications using happy-dom for exposure to untrusted HTML input
• Review logs for any indicators of exploitation attempts
• Consider temporarily disabling features that process untrusted HTML until patching is complete

Patch Information

The vulnerability has been fixed in happy-dom version 15.10.2. The fix properly sanitizes URL inputs using JSON.stringify() to prevent code injection through template literal interpolation. Security patches are available through the following commits:

• GitHub Commit Update
• GitHub Commit Bug Fix

For complete details, refer to the GitHub Security Advisory GHSA-96g7-g7g9-jxw8.

Workarounds

• There are no known workarounds for this vulnerability - upgrading is required
• As a temporary measure, avoid processing untrusted HTML content with happy-dom until the patch is applied
• Consider using alternative DOM implementations with proper sandboxing if immediate upgrade is not possible

# Upgrade happy-dom to patched version
npm update happy-dom@15.10.2

# Or specify exact version in package.json
npm install happy-dom@^15.10.2 --save