Executive brief
Webpack is a popular JavaScript bundler used by millions of web applications. When developers configure Webpack with automatic public path resolution, the generated code can be tricked into loading JavaScript from attacker-controlled servers if an attacker can inject HTML tags with specific attributes. This vulnerability allows cross-site scripting (XSS) attacks on websites that permit users to add HTML (e.g., markdown renderers, forums, web-based email) and has been exploited in real-world applications like Canvas LMS.
Technical details
The vulnerability is a DOM Clobbering gadget in Webpack's AutoPublicPathRuntimeModule. When output.publicPath is "auto" or unset, Webpack generates runtime code that determines the script's base URL by checking document.currentScript.src. An attacker can shadow document.currentScript by injecting an HTML element (e.g., <img name="currentScript">) that the DOM traversal will return instead of the actual script element. The attacker-controlled element's src attribute then becomes __webpack_require__.p (the public path), causing Webpack's dynamic imports to load modules from the attacker's domain. This requires that the page allows injection of scriptless HTML elements with unsanitized name or id attributes. The vulnerability affects Webpack versions <5.94.0, and a patch has been applied that validates document.currentScript is actually a SCRIPT tag before using its src attribute.
Affected products
- Webpack Webpack <5.94.0
Timeline
- 2024-08-27: disclosed: Vulnerability published via GHSA-4vvj-4cpr-p986
- 2024-08-27: patched: Fix released in Webpack 5.94.0 (commit 955e057)
References
- https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
- https://github.com/webpack/webpack/issues/18718
- https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61
- https://github.com/webpack/webpack
- https://research.securitum.com/xss-in-amp4email-dom-clobbering
- https://scnps.co/papers/sp23_domclob.pdf