DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
Not confirmed exploited. 1 of 8 rule sources name it.
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a… More
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.
Edge coverage
Claimed by vendorsAsk Vigil
AI · answers from this pageWorkers AI (Llama 3.3). Can be wrong: check the cited source.
Severity, decoded
CVSS 3.1Exploitable over the network under specific conditions, with low privileges and no user interaction, leading to low impact on confidentiality and integrity and full loss of availability.
How the score is built
- Attack vectorAn attacker can reach it over the internet; no access to your network needed.Network
- Attack complexityThe attack only works when conditions outside the attacker's control line up.High
- Privileges requiredThe attacker needs an ordinary user account.Low
- User interactionNo one has to click or open anything; the attack works on its own.None
- ScopeThe damage stays within the vulnerable component.Unchanged
- Confidentiality impactAn attacker can read some data, but has no control over what they get.Low
- Integrity impactAn attacker can change some data, but with limited control or limited effect.Low
- Availability impactAn attacker can take the component down completely or keep it from serving anyone.High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:HPublic exploit code or a detailed write-up exists, but CISA has not seen attacks.
At least one step needs hands-on work, which slows mass attacks.
A successful attack gives limited control over the affected software or limited access to its data.
Public exploits
None foundNo exploit in Exploit-DB or Metasploit, and no scanner template. That lowers, but doesn't remove, the chance of mass exploitation.
Timeline
- 2024-08-27CVE publishedCVE List
- 2024-11-12F5 ships a ruleDOM Clobber Malformed CurrentScript in Vite and Webpack
Vendor statements
QuotedCloudflareWAF Managed Rules
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
AWSAWS WAF Managed Rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. AWS often describes a vulnerability without naming its CVE (for example "Log4j"). We count only entries that name the CVE, so AWS coverage is understated.
Microsoft AzureFront Door and Application Gateway WAF (DRS)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.
Google CloudCloud Armor preconfigured WAF rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Google names few CVEs: the release notes start in May 2024 and the rules reference lists CVEs without dates. Its cve-canary rules are opt-in.
FastlyNext-Gen WAF virtual patches
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
F5Attack signatures (Distributed Cloud WAF)
First rule 2024-11-12, 77 days after the CVE was published.
Added: signature 200101884 "DOM Clobber Malformed CurrentScript in Vite and Webpack" (Cross Site Scripting (XSS), risk Medium), systems: JavaScript. References: CVE-2024-43788, CVE-2024-45812.
AkamaiApp & API Protector (Adaptive Security Engine)
This vendor publishes no machine-readable rule changelog we can check.
OWASP CRSCore Rule Set (open source, used inside many WAFs)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.
Social
No posts seen yet on X, Bluesky, Mastodon, Hacker News or GitHub.