Executive brief
Stage.js is a lightweight library used for building interactive web applications and games. A DOM Clobbering vulnerability in the library's resource loading mechanism allows attackers to inject HTML elements that hijack the script source URL, enabling arbitrary script loading from attacker-controlled servers. This can lead to complete compromise of the affected web application and its users' data.
Technical details
The vulnerability is a DOM Clobbering issue (CWE-79, CWE-94) in Stage.js's getScriptSrc() function. The function uses document.currentScript to obtain the base URL for script resources, but this lookup can be shadowed by attacker-injected HTML elements (such as img tags with name="currentScript"). An attacker with the ability to inject HTML into a webpage (through comments, posts, or other user-controlled content that bypasses HTML sanitization) can override document.currentScript with a malicious element, causing subsequent resource loading via Stage.preload() to fetch scripts from an attacker-controlled domain. The attack requires the attacker to inject unsanitized HTML but does not require JavaScript execution, authentication, or user interaction. Successful exploitation results in arbitrary script execution in the victim's browser within the context of the vulnerable application.
Affected products
- piqnt Stage.js through 0.8.10
Timeline
- 2024-10-31: disclosed
- 2025-03-03: advisory