DOMPurify Cross-Site Scripting Vulnerability via 'selectedcontent' Element

A cross-site scripting (XSS) vulnerability has been identified in DOMPurify version 3.4.4. The issue arises from the default allowance of the 'selectedcontent' element, which enables a mechanism where browsers can 're-clone' an XSS payload after it has been sanitized. This process results in the return of unsanitized markup within the 'selectedcontent' element. The vulnerability is present in DOMPurify versions prior to 3.4.5.

Impact

Exploitation of this vulnerability allows for a bypass of the DOMPurify sanitizer, leading to cross-site scripting (XSS) vulnerabilities.

Reproduction

The vulnerability can be reproduced by sanitizing HTML that includes a 'selectedcontent' element within a 'select' dropdown. After sanitization, the browser re-clones the 'selectedcontent' from the original 'option', which has not been properly sanitized, and inserts it back into the DOM. This process can be automated with a proof-of-concept script that demonstrates the XSS payload execution.

Remediation

Users are advised to update DOMPurify to version 3.4.5 or later, where this issue has been fixed.