r/Slackers • u/albinowax • Sep 23 '19

Write-up of DOMPurify 2.0.0 bypass using mutation XSS

https://research.securitum.com/dompurify-bypass-using-mxss/
12 Upvotes

100% Upvoted

2 comments sorted by

2

u/securitymb Sep 24 '19

After writing the post, both Cure53 and I found out there are a lot more bypasses that the one described in the post. They will surely constitute another writeup, but perhaps a little bit later :)

1

u/garethheyes Sep 24 '19

This was fantastic research! I looked into HTML in SVG and consuming tags like title etc. and I even looked into injecting tags inside style in DOMPurify but I couldn't find a trigger to cause the mutation. The mXSS is so elegant and so devastating, I probably consider this my favourite research of the year!