[PR #304] [CLOSED] [Security] Fix MEDIUM vulnerability: CVE-2024-53382 #227

New Issue

adam · 2025-12-29T07:19:57+01:00

adam commented

2025-12-29 07:19:57 +01:00

📋 Pull Request Information

Original PR: https://github.com/mountain-loop/yaak/pull/304
Author: @orbisai0security
Created: 11/21/2025
Status: ❌ Closed

Base: main ← Head: fix-cve-2024-53382-package-lock.json

📝 Commits (1)

6477dfc fix: resolve medium vulnerability CVE-2024-53382

📊 Changes

2 files changed (+5 additions, -4 deletions)

View changed files

📝 package-lock.json (+3 -3)
📝 package.json (+2 -1)

📄 Description

Security Fix

This PR addresses a MEDIUM severity vulnerability detected by our security scanner.

Security Impact Assessment

Aspect	Rating	Rationale
Impact	Medium	In Yaak, an API client that uses PrismJS for syntax highlighting of code snippets like JSON responses, exploitation could lead to DOM clobbering if user-controlled content is rendered as HTML, potentially enabling XSS in the Electron renderer process and limited code execution within the app's sandboxed environment.
Likelihood	Low	Yaak is a desktop API testing tool not exposed to remote attacks, requiring an attacker to trick a user into loading malicious API responses or content that exploits the prism-autoloader plugin, which is unlikely given its developer-focused usage and lack of direct internet exposure.
Ease of Fix	Easy	Remediation involves updating the PrismJS dependency to a patched version via npm, as indicated by the provided commit and pull request links, with minimal risk of breaking changes since it's a library update without altering Yaak's core code.

Evidence: Proof-of-Concept Exploitation Demo

⚠️ For Educational/Security Awareness Only

This demonstration shows how the vulnerability could be exploited to help you understand its severity and prioritize remediation.

How This Vulnerability Can Be Exploited

The DOM Clobbering vulnerability in PrismJS's prism-autoloader plugin allows an attacker to overwrite the global Prism object with a DOM element by injecting HTML containing an element with id="Prism". In the context of Yaak, an API client that uses PrismJS for syntax highlighting in its web-based frontend (built with Tauri), an attacker could exploit this by tricking a user into making an API request to a malicious server that returns HTML content designed to clobber the Prism object. If Yaak's response viewer has an HTML preview or rendering mode (common in API clients like Yaak for displaying response bodies), loading this HTML could interfere with PrismJS's autoloader functionality, potentially causing syntax highlighting failures or unexpected behavior in the app's UI.

The DOM Clobbering vulnerability in PrismJS's prism-autoloader plugin allows an attacker to overwrite the global Prism object with a DOM element by injecting HTML containing an element with id="Prism". In the context of Yaak, an API client that uses PrismJS for syntax highlighting in its web-based frontend (built with Tauri), an attacker could exploit this by tricking a user into making an API request to a malicious server that returns HTML content designed to clobber the Prism object. If Yaak's response viewer has an HTML preview or rendering mode (common in API clients like Yaak for displaying response bodies), loading this HTML could interfere with PrismJS's autoloader functionality, potentially causing syntax highlighting failures or unexpected behavior in the app's UI. This requires the user to actively preview the malicious HTML response, making exploitation conditional on user interaction and Yaak's feature set.

<!-- PoC HTML that an attacker could serve as an API response body (e.g., via a malicious server endpoint).
   In Yaak, if the user sends a GET request to http://malicious-server.com/exploit and previews the HTML response,
   this would clobber the Prism global in the app's webview, assuming PrismJS autoloader is loaded for highlighting. -->
<!DOCTYPE html>
<html lang="en">
<head>
    <title>Malicious Response</title>
    <!-- Include PrismJS resources as used in Yaak's frontend (based on package-lock.json dependency) -->
    <link href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism.min.css" rel="stylesheet" />
</head>
<body>
    <!-- This div clobbers the global Prism object, making window.Prism refer to this DOM element instead of the PrismJS library object -->
    <div id="Prism">Clobbered Prism Object - Syntax Highlighting May Fail</div>
    
    <!-- Example code block that Prism autoloader would attempt to highlight, but clobbering disrupts normal operation -->
    <pre><code class="language-javascript">console.log('This code highlighting may not work due to clobbering');</code></pre>
    
    <!-- Scripts loaded as in Yaak's frontend -->
    <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-core.min.js"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/autoloader/prism-autoloader.min.js"></script>
</body>
</html>

# Steps to reproduce in a test environment (do not run on production systems):
# 1. Set up a local malicious server to serve the above HTML (e.g., using Python's http.server)
echo 'Serve the PoC HTML above from a local server on port 8000' > /dev/null
python3 -m http.server 8000

# 2. In Yaak, create a new request to http://localhost:8000 (or a remote malicious URL)
# 3. Send the request and switch to HTML preview mode in the response viewer (if available in Yaak)
# 4. Observe that Prism is clobbered: Open browser dev tools in Yaak's webview and check that window.Prism is now a DOM element (<div id="Prism">) instead of the PrismJS object
# 5. Attempt to highlight code; the autoloader may fail to load languages dynamically, leading to unhighlighted or broken code display

Exploitation Impact Assessment

Impact Category	Severity	Description
Data Exposure	None	No sensitive data (e.g., API keys, user credentials, or response data stored in Yaak) can be accessed or leaked through this client-side DOM Clobbering; it only affects the PrismJS object in the app's webview and does not interact with Yaak's data handling or storage.
System Compromise	None	This is a client-side vulnerability in the web frontend; it cannot grant system access, execute arbitrary code on the host, or escape the Tauri sandbox. The clobbering is limited to disrupting PrismJS functionality within the app's UI.
Operational Impact	Low	Successful exploitation could cause syntax highlighting failures in Yaak's response viewer, leading to degraded user experience (e.g., unreadable code snippets in API responses). It does not cause service disruptions, crashes, or resource exhaustion beyond minor UI issues.
Compliance Risk	Low	May violate general web security best practices (e.g., OWASP Top 10 A03:2021 Injection risks in client-side libraries), but poses no direct risk to regulations like GDPR or SOC2, as it does not handle or expose user data. Remediation aligns with secure dependency management standards.

Vulnerability Details

Rule ID: CVE-2024-53382
File: package-lock.json
Description: prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin

Changes Made

This automated fix addresses the vulnerability by applying security best practices.

Files Modified

package-lock.json
package.json

Verification

This fix has been automatically verified through:

✅ Build verification
✅ Scanner re-scan
✅ LLM code review

🤖 This PR was automatically generated.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/mountain-loop/yaak/pull/304 **Author:** [@orbisai0security](https://github.com/orbisai0security) **Created:** 11/21/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix-cve-2024-53382-package-lock.json` --- ### 📝 Commits (1) - [`6477dfc`](https://github.com/mountain-loop/yaak/commit/6477dfc6bedfe56cc131dc92c98dd59e7fcd30b8) fix: resolve medium vulnerability CVE-2024-53382 ### 📊 Changes **2 files changed** (+5 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+3 -3) 📝 `package.json` (+2 -1) </details> ### 📄 Description ## Security Fix This PR addresses a **MEDIUM** severity vulnerability detected by our security scanner. ### Security Impact Assessment | Aspect | Rating | Rationale | |--------|--------|-----------| | Impact | Medium | In Yaak, an API client that uses PrismJS for syntax highlighting of code snippets like JSON responses, exploitation could lead to DOM clobbering if user-controlled content is rendered as HTML, potentially enabling XSS in the Electron renderer process and limited code execution within the app's sandboxed environment. | | Likelihood | Low | Yaak is a desktop API testing tool not exposed to remote attacks, requiring an attacker to trick a user into loading malicious API responses or content that exploits the prism-autoloader plugin, which is unlikely given its developer-focused usage and lack of direct internet exposure. | | Ease of Fix | Easy | Remediation involves updating the PrismJS dependency to a patched version via npm, as indicated by the provided commit and pull request links, with minimal risk of breaking changes since it's a library update without altering Yaak's core code. | ### Evidence: Proof-of-Concept Exploitation Demo **⚠️ For Educational/Security Awareness Only** This demonstration shows how the vulnerability could be exploited to help you understand its severity and prioritize remediation. #### How This Vulnerability Can Be Exploited The DOM Clobbering vulnerability in PrismJS's prism-autoloader plugin allows an attacker to overwrite the global `Prism` object with a DOM element by injecting HTML containing an element with `id="Prism"`. In the context of Yaak, an API client that uses PrismJS for syntax highlighting in its web-based frontend (built with Tauri), an attacker could exploit this by tricking a user into making an API request to a malicious server that returns HTML content designed to clobber the `Prism` object. If Yaak's response viewer has an HTML preview or rendering mode (common in API clients like Yaak for displaying response bodies), loading this HTML could interfere with PrismJS's autoloader functionality, potentially causing syntax highlighting failures or unexpected behavior in the app's UI. The DOM Clobbering vulnerability in PrismJS's prism-autoloader plugin allows an attacker to overwrite the global `Prism` object with a DOM element by injecting HTML containing an element with `id="Prism"`. In the context of Yaak, an API client that uses PrismJS for syntax highlighting in its web-based frontend (built with Tauri), an attacker could exploit this by tricking a user into making an API request to a malicious server that returns HTML content designed to clobber the `Prism` object. If Yaak's response viewer has an HTML preview or rendering mode (common in API clients like Yaak for displaying response bodies), loading this HTML could interfere with PrismJS's autoloader functionality, potentially causing syntax highlighting failures or unexpected behavior in the app's UI. This requires the user to actively preview the malicious HTML response, making exploitation conditional on user interaction and Yaak's feature set. ```html  <!DOCTYPE html> <html lang="en"> <head> <title>Malicious Response</title>  <link href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism.min.css" rel="stylesheet" /> </head> <body>  <div id="Prism">Clobbered Prism Object - Syntax Highlighting May Fail</div>  <pre><code class="language-javascript">console.log('This code highlighting may not work due to clobbering');</code></pre>  <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-core.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/autoloader/prism-autoloader.min.js"></script> </body> </html> ``` ```bash # Steps to reproduce in a test environment (do not run on production systems): # 1. Set up a local malicious server to serve the above HTML (e.g., using Python's http.server) echo 'Serve the PoC HTML above from a local server on port 8000' > /dev/null python3 -m http.server 8000 # 2. In Yaak, create a new request to http://localhost:8000 (or a remote malicious URL) # 3. Send the request and switch to HTML preview mode in the response viewer (if available in Yaak) # 4. Observe that Prism is clobbered: Open browser dev tools in Yaak's webview and check that window.Prism is now a DOM element (<div id="Prism">) instead of the PrismJS object # 5. Attempt to highlight code; the autoloader may fail to load languages dynamically, leading to unhighlighted or broken code display ``` #### Exploitation Impact Assessment | Impact Category | Severity | Description | |-----------------|----------|-------------| | Data Exposure | None | No sensitive data (e.g., API keys, user credentials, or response data stored in Yaak) can be accessed or leaked through this client-side DOM Clobbering; it only affects the PrismJS object in the app's webview and does not interact with Yaak's data handling or storage. | | System Compromise | None | This is a client-side vulnerability in the web frontend; it cannot grant system access, execute arbitrary code on the host, or escape the Tauri sandbox. The clobbering is limited to disrupting PrismJS functionality within the app's UI. | | Operational Impact | Low | Successful exploitation could cause syntax highlighting failures in Yaak's response viewer, leading to degraded user experience (e.g., unreadable code snippets in API responses). It does not cause service disruptions, crashes, or resource exhaustion beyond minor UI issues. | | Compliance Risk | Low | May violate general web security best practices (e.g., OWASP Top 10 A03:2021 Injection risks in client-side libraries), but poses no direct risk to regulations like GDPR or SOC2, as it does not handle or expose user data. Remediation aligns with secure dependency management standards. | ### Vulnerability Details - **Rule ID**: `CVE-2024-53382` - **File**: `package-lock.json` - **Description**: prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin ### Changes Made This automated fix addresses the vulnerability by applying security best practices. ### Files Modified - `package-lock.json` - `package.json` ### Verification This fix has been automatically verified through: - ✅ Build verification - ✅ Scanner re-scan - ✅ LLM code review 🤖 This PR was automatically generated. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

adam added the pull-request label 2025-12-29 07:19:57 +01:00

adam closed this issue

2025-12-29 07:19:57 +01:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/yaak#227