Webpack DOM Clobbering Vulnerability in AutoPublicPathRuntimeModule Leading to Cross-Site Scripting

A DOM clobbering vulnerability has been identified in Webpack's AutoPublicPathRuntimeModule, affecting versions prior to 5.93.0. This vulnerability allows for cross-site scripting (XSS) attacks in web pages that include Webpack-generated files and permit the injection of certain scriptless HTML elements, such as an image tag with an unsanitized name attribute. The issue arises when the output.publicPath configuration is set to auto or left unset, enabling an attacker to manipulate the current script context and inject malicious payloads that are executed as JavaScript. This vulnerability has been observed in the Canvas Learning Management System, where it was exploited through Webpack-compiled code.

Impact

Exploitation of this vulnerability can lead to cross-site scripting (XSS) attacks, allowing for the execution of malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a Webpack project and set the output.publicPath to 'auto' or leave it unset. Then, compile the project and upload the resulting JavaScript bundle to a server. Inject an image tag with an unsanitized name attribute into a webpage that loads the Webpack bundle. The injected image tag will clobber the DOM, allowing for the execution of arbitrary JavaScript code.

Remediation

Users are advised to upgrade Webpack to version 5.94.0 or later, where this vulnerability has been patched.