Executive brief
dompurify is a widely-used JavaScript library that sanitizes HTML, MathML, and SVG content to prevent cross-site scripting (XSS) attacks. Versions prior to 2.0.3 contain a bypass vulnerability that allows attackers to execute arbitrary JavaScript in users' browsers by crafting specially-formed combinations of SVG and Math tags. This could enable attackers to steal session cookies, redirect users to malicious sites, or perform actions on behalf of victims.
Technical details
The vulnerability is a Mutation XSS (mXSS) bypass in dompurify's XSS filter, affecting versions before 2.0.3. The root cause lies in insufficient sanitization of SVG and Math elements when combined with closing tags like </p> and </br>. An attacker can craft a payload such as <svg></p><style><a id="</style><img src=1 onerror=alert(1)>"> that bypasses the filter due to parser differential behavior in Chrome and Safari. This allows arbitrary JavaScript execution without requiring authentication or special user interaction beyond opening a crafted HTML page. The fix is available in version 2.0.3 or later; alternatively, administrators can configure dompurify to forbid SVG and Math tags entirely.
Affected products
- cure53 dompurify < 2.0.3
Timeline
- 2020-08-28: disclosed
- 2020: patched: Fixed in version 2.0.3