CVE-2024-48910

What it actually does

Allows an attacker to pollute the JavaScript object prototype through specially crafted input processed by the sanitizer, potentially altering the behavior of the application and bypassing security controls.

Why it matters to the business

Applications relying on this library for sanitizing user content may experience unexpected behavior or security control bypasses, increasing risk of data exposure or unauthorized actions in web environments.

How an attack unfolds

An attacker supplies malicious input containing prototype pollution payloads to the DOMPurify sanitization function, which fails to properly sanitize it, leading to modifications in the global Object prototype that can be leveraged for further attacks.

How to fix it

Update DOMPurify to version 2.4.2 or later, specifically applying commit f1e180fcccc2766a10b7a88ee133cd4d1d8e44e5 in the GIT repository.

How to confirm the fix worked

Verify the library version is at least 2.4.2 and test sanitization with known prototype pollution vectors to confirm they are neutralized.

Typical attack path

1. Identify application using vulnerable DOMPurify version
2. Craft prototype pollution payload in HTML/MathML/SVG input
3. Submit input to the sanitization endpoint
4. Observe or exploit side effects from polluted prototype

How to detect it

Monitor for unusual prototype modifications or errors in JavaScript execution related to object properties in applications using the sanitizer; review server logs for suspicious input patterns targeting sanitization functions.

What your security team should do

• Prioritize updating all instances of DOMPurify to the fixed version
• Review applications for direct or indirect use of this library
• Implement additional input validation where possible