DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Description

We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g.

Recommendation

Update the rollup package to the latest compatible version. Followings are version details:

• Affected version(s): **< 2.79.2

  >= 3.0.0, < 3.29.5

  >= 4.0.0, < 4.22.4**

• Patched version(s): **2.79.2

  3.29.5

  4.22.4**

References

• GHSA-gcx4-mw62-g8wm
• CVE-2024-47068
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - CVE-2024-43788
• DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS - Vulnerability
• Layui has DOM Clobbering gadgets that leads to Cross-site Scripting - CVE-2024-47075
• DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui - CVE-2024-45389

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

rollup