Exploitation Summary
EIP tracks 4 public exploits for CVE-2024-48910. PoCs published by Galaxy-sc, Mitchellzhou1, Alex-Acero-Security.
AI-analyzed exploit summary This repository contains a Go-based scanner designed to detect vulnerable deployments of DOMPurify (versions up to 3.4.4) by analyzing JavaScript bundles for the presence of DOMPurify and the `<selectedcontent>` tag, which indicates a potential XSS bypass vulnerability.
Description
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
Exploits (4)
This repository contains a Go-based scanner designed to detect vulnerable deployments of DOMPurify (versions up to 3.4.4) by analyzing JavaScript bundles for the presence of DOMPurify and the `<selectedcontent>` tag, which indicates a potential XSS bypass vulnerability.
This repository contains a Go-based scanner designed to detect vulnerable deployments of DOMPurify (versions < 3.4.5) by analyzing JavaScript bundles for the presence of specific patterns indicative of the mXSS vulnerability involving the `<selectedcontent>` tag.
The repository provides a functional proof-of-concept for CVE-2024-48910, demonstrating a prototype pollution vulnerability in DOMPurify that allows bypassing XSS protections by manipulating `Object.prototype.hasOwnProperty` and `ALLOWED_ATTR`. The PoC includes executable JavaScript code that exploits the vulnerability to achieve XSS.
This repository contains a functional proof-of-concept for CVE-2024-48910, demonstrating a prototype pollution vulnerability in a Node.js server. The exploit leverages unsafe object merging to manipulate `Object.prototype`, which can lead to arbitrary code execution in client-side JavaScript.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N