Medium, CVSS 6.3npmAmendedPublished
DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS
GHSA-84jw-g43v-8gjm
- Affected
- npm @rspack/core < 1.0.0-rc.1
- Fixed in
- 1.0.0-rc.1· Vendor fix available
- Issue
- Hi, Rspack|Webpack developer team! Summary We discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. We found the real-world exploitation of this gadget in the Canvas LMS which allows XSS attack happens through an javascript code compiled by Webpack (the vulnerable part is from Webpack). We believe this is a severe issue. If Webpack’s code is not resilient to DOM Clobbering attacks, it could lead to significant security vulnerabilities in any web application using Webpack-compiled code. Details Backgrounds DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing…
Recommended action: Upgrade to 1.0.0-rc.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.