CVE-2024-45812

{"id": "CVE-2024-45812", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.6}]}, "published": "2024-09-17T20:15:06.037", "references": [{"url": "https://github.com/vitejs/vite/commit/ade1d89660e17eedfd35652165b0c26905259fad", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/security/advisories/GHSA-64vr-g452-qvp3", "source": "security-advisories@github.com"}, {"url": "https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986", "source": "security-advisories@github.com"}, {"url": "https://research.securitum.com/xss-in-amp4email-dom-clobbering", "source": "security-advisories@github.com"}, {"url": "https://scnps.co/papers/sp23_domclob.pdf", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server. This vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Vite es un framework de herramientas de compilaci\u00f3n de interfaz para javascript. Se descubri\u00f3 que las versiones afectadas de vite contienen una vulnerabilidad de DOM Clobbering al compilar scripts en formato de salida `cjs`/`iife`/`umd`. El gadget DOM Clobbering en el m\u00f3dulo puede provocar cross site scripting (XSS) en p\u00e1ginas web donde hay elementos HTML controlados por atacantes sin script (por ejemplo, una etiqueta img con un atributo de nombre no saneado). DOM Clobbering es un tipo de ataque de reutilizaci\u00f3n de c\u00f3digo en el que el atacante primero incorpora un fragmento de marcado HTML aparentemente benigno que no es un script en la p\u00e1gina web (por ejemplo, a trav\u00e9s de una publicaci\u00f3n o comentario) y aprovecha los gadgets (fragmentos de c\u00f3digo js) que se encuentran en el c\u00f3digo javascript existente para transformarlo en c\u00f3digo ejecutable. Hemos identificado una vulnerabilidad de DOM Clobbering en los scripts incluidos en Vite, en particular cuando los scripts importan din\u00e1micamente otros scripts desde la carpeta de activos y el desarrollador establece el formato de salida de compilaci\u00f3n en `cjs`, `iife` o `umd`. En tales casos, Vite reemplaza las rutas relativas que comienzan con `__VITE_ASSET__` utilizando la URL recuperada de `document.currentScript`. Sin embargo, esta implementaci\u00f3n es vulnerable a un ataque DOM Clobbering. La b\u00fasqueda `document.currentScript` puede ser ocultada por un atacante a trav\u00e9s del mecanismo de acceso al elemento del \u00e1rbol DOM nombrado del navegador. Esta manipulaci\u00f3n permite a un atacante reemplazar el elemento de script deseado con un elemento HTML malicioso. Cuando esto sucede, el atributo src del elemento controlado por el atacante se utiliza como la URL para importar scripts, lo que potencialmente conduce a la carga din\u00e1mica de scripts desde un servidor controlado por el atacante. Esta vulnerabilidad puede resultar en ataques de cross site scripting (XSS) en sitios web que incluyen archivos incluidos en Vite (configurados con un formato de salida de `cjs`, `iife` o `umd`) y permiten a los usuarios inyectar ciertas etiquetas HTML sin scripts sin sanear adecuadamente los atributos name o id. Este problema se ha corregido en las versiones 5.4.6, 5.3.6, 5.2.14, 4.5.5 y 3.2.11. Se recomienda a los usuarios que actualicen la versi\u00f3n. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-09-20T12:30:51.220", "sourceIdentifier": "security-advisories@github.com"}