kibana - GHSA-cj63-jhhr-wcxv
Back to Overview
Detailed information about this CVE

Severity

MEDIUM

Description

## Summary When `USE_PROFILES` is enabled, DOMPurify rebuilds `ALLOWED_ATTR` as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via `ALLOWED_ATTR[lcName]`, any `Array.prototype` property that is polluted also counts as an allowlisted attribute. An attacker who can set `Array.prototype.onclick = true` (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as `onclick` even when they are normally forbidden. The provided PoC sanitizes `<img onclick=...>` with `USE_PROFILES` and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector. ## Impact Prototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered. ## Credits Identified by Cantina’s Apex (https://www.cantina.security).

CVSS Scores

Affected Versions

  • 9.3.1
  • 9.3.0
  • 9.2.6
  • 9.2.5
  • 9.2.4
  • 9.2.3
  • 9.2.2
  • 9.1.10
  • 9.1.9
  • 9.1.8
  • 8.19.12
  • 8.19.11
  • 8.19.10
  • 8.19.9
  • 8.19.8

Not Affected Versions

  • 9.4.0
  • 9.3.4
  • 9.3.3
  • 9.3.2
  • 9.2.8
  • 9.2.7
  • 9.2.1
  • 9.2.0
  • 9.1.7
  • 9.1.6
  • 9.1.5
  • 9.1.4
  • 9.1.3
  • 9.1.2
  • 9.1.1
  • 9.1.0
  • 9.0.8
  • 9.0.7
  • 9.0.6
  • 9.0.5
  • 9.0.4
  • 9.0.3
  • 9.0.2
  • 9.0.1
  • 9.0.0
  • 8.19.15
  • 8.19.14
  • 8.19.13
  • 8.19.7
  • 8.19.6
  • 8.19.5
  • 8.19.4
  • 8.19.3
  • 8.19.2
  • 8.19.1
  • 8.19.0
  • 8.18.8
  • 8.18.7
  • 8.18.6
  • 8.18.5
  • 8.18.4
  • 8.18.3
  • 8.18.2
  • 8.18.1
  • 8.18.0
  • 8.17.10
  • 8.17.9
  • 8.17.8
  • 8.17.7
  • 8.17.6
  • 8.17.5
  • 8.17.4
  • 8.17.3
  • 8.17.2
  • 8.17.1
  • 8.17.0
  • 8.16.6
  • 8.16.5
  • 8.16.4
  • 8.16.3
  • 8.16.2
  • 8.16.1
  • 8.16.0
  • 8.15.5
  • 8.15.4
  • 8.15.3
  • 8.15.2
  • 8.15.1
  • 8.15.0
  • 8.14.3
  • 8.14.2
  • 8.14.1
  • 8.14.0
  • 8.13.4
  • 8.13.3
  • 8.13.2
  • 8.13.1
  • 8.13.0
  • 8.12.2
  • 8.12.1
  • 8.12.0
  • 8.11.4
  • 8.11.3
  • 8.11.2
  • 8.11.1
  • 8.11.0
  • 8.10.4
  • 8.10.3
  • 8.10.2
  • 8.10.1
  • 8.9.2
  • 8.9.1
  • 8.9.0
  • 8.8.2
  • 8.8.1
  • 8.8.0
  • 8.7.1
  • 8.7.0
  • 8.6.2
  • 8.6.1
  • 8.6.0
  • 8.5.3
  • 8.5.2
  • 8.5.1
  • 8.5.0
  • 8.4.3
  • 8.4.2
  • 8.4.1
  • 8.4.0
  • 8.3.3
  • 8.3.2
  • 8.3.1
  • 8.3.0
  • 8.2.3
  • 8.2.2
  • 8.2.1
  • 8.2.0
  • 8.1.3
  • 8.1.2
  • 8.1.1
  • 8.1.0
  • 8.0.1
  • 8.0.0