CVE-2024-53382

What it actually does

The vulnerability allows for DOM Clobbering, where an attacker can inject specific HTML elements (e.g., `<img id="currentScript">`) to create global JavaScript variables that shadow legitimate browser objects. PrismJS, when looking for `document.currentScript`, can be tricked into referencing an attacker-controlled HTML element instead of its own script tag. This can lead to the library processing attributes from the malicious element, resulting in Cross-Site Scripting (XSS) without the need for traditional `<script>` tags in the payload.

Why it matters to the business

Exploitation of this vulnerability can lead to the compromise of user accounts and data. Attackers can steal session cookies to impersonate users, access sensitive information, perform unauthorized actions, or deface web pages. This can result in reputational damage, loss of customer trust, and potential regulatory fines if sensitive user data is breached.

How an attack unfolds

An attacker targets a web application using a vulnerable version of PrismJS that displays user-supplied content. The attacker submits a specially crafted HTML payload, for example in a comment field. This payload does not contain a `<script>` tag but includes an element like `<img id="currentScript" src="x" onerror="alert('XSS')">`. When a victim views the page, this element clobbers the `document.currentScript` property. When PrismJS initializes, it mistakenly reads this attacker-controlled element as its own script, processes its attributes, and triggers the `onerror` event, executing the attacker's arbitrary JavaScript in the victim's browser.

How to fix it

Upgrade PrismJS to a version later than 1.29.0. The recommended action is to update to the latest stable version available. If an immediate upgrade is not feasible, implement strict input sanitization on all user-provided content using a library that is aware of and mitigates DOM Clobbering attacks. Additionally, implement a strong Content Security Policy (CSP) to restrict the execution of inline scripts and control resource loading as a defense-in-depth measure.

How to confirm the fix worked

To confirm remediation, verify that all instances of the PrismJS library in your applications are updated to a version greater than 1.29.0. Check project dependency files (e.g., `package.json`, `yarn.lock`, `pom.xml`) and inspect the version numbers within the `prism.js` files themselves. To test for exposure, you can manually inject a payload like `<img id="currentScript">` into a relevant input field and use browser developer tools to inspect if the `document.currentScript` object is successfully overwritten by the injected element.

Typical attack path

1. The attacker identifies a target website using PrismJS version 1.29.0 or earlier to render user-provided content.
2. The attacker crafts an HTML payload containing an element with its `id` or `name` attribute set to `currentScript`.
3. The payload is submitted to the website through a feature like a comment section, forum post, or user profile.
4. A victim user navigates to the page containing the malicious payload.
5. The browser renders the page, and the attacker's element overwrites the `document.currentScript` property in the DOM.
6. PrismJS executes, reads the malicious element instead of its own script, and its logic triggers the execution of JavaScript embedded in the element's attributes (e.g., `onerror`).
7. The attacker's script runs in the victim's browser, achieving XSS.

How to detect it

To detect potential exploitation, security teams should search web server access logs, WAF logs, and application database records for suspicious HTML payloads. Look for submissions containing HTML elements with `id` or `name` attributes set to `currentScript`. Specifically, search for patterns like `<img id="currentScript">`, `<form id="currentScript">`, or `<a name="currentScript">` within user-generated content fields. On the client-side, monitor for anomalous script executions originating from non-script elements on pages that utilize PrismJS.

• id="currentScript"
• name="currentScript"

What your security team should do

• Immediately identify all applications using PrismJS and prioritize upgrading those that are public-facing or handle user-generated content to a version later than 1.29.0.
• Perform a comprehensive code and dependency scan to locate all instances of the vulnerable library, including vendored copies.
• Review and enforce a strict Content Security Policy (CSP) to limit the impact of this and future XSS vulnerabilities.
• Ensure that a robust HTML sanitization library, configured to prevent DOM Clobbering, is used for all untrusted HTML content before it is rendered.