Executive brief
Layui is a popular JavaScript UI framework used to build interactive web interfaces. A DOM Clobbering vulnerability allows attackers to inject specially crafted HTML elements (like img tags with unsanitized attributes) that can be transformed into executable code, leading to Cross-site Scripting (XSS) attacks. This could allow attackers to steal user data, session credentials, or perform unauthorized actions on behalf of users.
Technical details
A DOM Clobbering vulnerability exists in Layui where attacker-controlled HTML elements with unsanitized name or id attributes can be leveraged through gadgets in the library to execute arbitrary JavaScript code. The vulnerability is triggered when web pages allow users to inject scriptless HTML tags (such as img elements) without proper sanitization. An attacker with ability to inject HTML into a page (e.g., via comments or posts) can exploit this to achieve XSS without directly injecting script tags. The vulnerability requires low privileges and high attack complexity but allows confidentiality and integrity impacts with high availability impact. This issue has been patched in Layui version 2.9.17; users should upgrade immediately.
Affected products
- Layui Layui < 2.9.17
Timeline
- 2024-09-26: disclosed
- 2024-09-26: patched: Fixed in version 2.9.17