DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS (CVE-2024-47068)

The vulnerability is a DOM Clobbering gadget in rollup's bundled scripts when using import.meta.url in cjs, umd, or iife output formats. Rollup replaces import.meta.url with a URL derived from document.currentScript.src, but this lookup can be shadowed by an attacker via named DOM elements (e.g., an img tag with name='currentScript'). This allows an attacker to control the URL used for script loading, enabling XSS. The vulnerability is demonstrated by injecting an img tag with name='currentScript' and a malicious src, causing the page to load scripts from an attacker-controlled server. The issue is mitigated by patching rollup to verify that document.currentScript is a SCRIPT element before using its src attribute.

This vulnerability can lead to cross-site scripting (XSS) attacks on websites that include rollup-bundled scripts configured with cjs, umd, or iife output formats and use import.meta.url, if those websites allow injection of scriptless HTML elements with unsanitized name or id attributes. Exploitation enables attackers to load and execute arbitrary scripts from attacker-controlled domains, potentially compromising the confidentiality, integrity, and availability of affected web applications.

A patch is available for rollup that adds type checking to ensure document.currentScript is a SCRIPT element before using its src attribute, preventing DOM Clobbering attacks. Users should upgrade rollup to a fixed version >=4.22.4. Until patched, avoid allowing untrusted user input to inject HTML elements with name or id attributes that could shadow document.currentScript. Follow the vendor advisory for the official fix and update instructions.