CVE-2024-45812: Vite DOM Clobbering gadget leads to XSS in bundled scripts

CVE-2024-45812 · Severity: low · CVSS 3.1 · Published 2024-09-17

Vite is a popular build tool used to bundle JavaScript applications for the web. When configured to output bundles in CommonJS, IIFE, or UMD formats, Vite generates code vulnerable to DOM Clobbering attacks—a technique where an attacker injects innocent-looking HTML elements (like image tags) that trick the bundled script into loading malicious scripts from attacker-controlled servers. This can result in cross-site scripting (XSS) and compromise of user sessions and data.

Technologies: Vite. Vendors: Vite.

Quick answers

Is CVE-2024-45812 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-45812 being exploited in the wild.
How severe is CVE-2024-45812?
Low severity, with a CVSS score of 3.1, published 17 September 2024.
Which products and versions are affected?
Vite >=5.4.0, <=5.4.5; >=5.3.0, <=5.3.5; >=5.1.0, <=5.2.13; >=5.0.0, <=5.1.7; >=4.0.0, <=4.5.3; <=3.2.10.
Is there a fix for CVE-2024-45812?
A patch was published on 2024-09-17: Patches available: 5.4.6, 5.3.6, 5.2.14, 5.1.8, 4.5.5, 3.2.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45812 attacked?
It is attacked over the network or from the adjacent network.
Am I affected by CVE-2024-45812?
Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a DOM Clobbering gadget in Vite's asset URL resolution mechanism. When building with cjs/iife/umd output formats and dynamic imports of assets, Vite uses `document.currentScript` to resolve asset URLs. An attacker can shadow this lookup via the browser's named DOM element access—by injecting an HTML element (e.g., `&lt;img name="currentScript"&gt;`) with a malicious `src` attribute, the bundled code uses that element's `src` as the script URL instead. This requires the ability to inject scriptless HTML (via markdown renderers, comment sections, or HTML injection vulnerabilities in third-party JS). No user interaction or authentication is required beyond the initial HTML injection capability. Patches are available in Vite 5.4.6, 5.3.6, 5.2.14, 5.1.8, 4.5.5, and 3.2.11.

Affected products

  • Vite Vite >=5.4.0, <=5.4.5; >=5.3.0, <=5.3.5; >=5.1.0, <=5.2.13; >=5.0.0, <=5.1.7; >=4.0.0, <=4.5.3; <=3.2.10

Identifiers

  • CVE-2024-45812
  • GHSA-64vr-g452-qvp3

Timeline

  • 2024-09-17: disclosed
  • 2024-09-17: patched: Patches available: 5.4.6, 5.3.6, 5.2.14, 5.1.8, 4.5.5, 3.2.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.