AI
DOM Clobbering: An Old Feature, A Modern Attack
DOM clobbering exploits an HTML specification feature that allows named lookups on window or document objects to access page elements. When an attacker injects an element whose ID or name matches a JavaScript property, the lookup returns the attacker’s DOM element instead of the expected value. The attack works even when XSS is blocked, because raw HTML with specific attributes (ID, name) slips past sanitizers. In a typical scenario, an injected <a> tag with id="remote" clobbers a script’s fallback URL lookup, loading malicious code from the attacker’s domain.
Two Hard Problems: Dynamic JavaScript and Exploit Generation
Real-world JavaScript is minified, bundled, and full of dynamic operations like aliasing and computed property lookups. Static analysis fails to track data flow through these constructs. The second problem: the payload is a DOM element, not a string. To be a valid exploit, the element must satisfy every data-flow and control-flow constraint in the gadget code. A wrong tag name, missing attribute, or incompatible structure breaks the propagation before the payload reaches a sink. Prior tools like the prior static analyzer and DomInvader (canary-based) could not reliably produce working exploits.
Hawk’s Three-Stage Approach: Track, Constrain, Exploit
Hawk operates in three stages. First, it performs dynamic taint analysis on website-defined values that could be clobbered. It tracks how those values flow through the page, using a code-rewriting approach based on Jalangi to instrument JavaScript without modifying the browser. Second, it extracts data-flow and control-flow constraints from the taint trace and represents them in a symbolic DOM syntax. A constraint solver generates compatible HTML markups that satisfy all constraints. Third, it injects the crafted payload and replays execution to verify the canary value reaches the sink. The solver starts with local constraints, expands them into disjunctive normal form, merges across shared tainted nodes, and discards conflicting combinations.
Case Studies: Webpack, Astro, and an Editor
Hawk found 497 zero-day exploitable gadgets across the Tranco top 5,000 websites. In Webpack, the runtime code reads document.currentScript to determine the public path. An injected <script> with src pointing to an attacker server clobbers that lookup, causing arbitrary script loading. In Astro, the framework uses Array.from(document.scripts) inside a loop with two conditional checks. Hawk generated an HTML collection payload that bypassed both checks (absent data-astro-exec and type attributes) and wrote attacker-controlled innerHTML into a new script element. In the Editor (Yahoo! predecessor), window.editor_home_url was clobbered to redirect script loading to an attacker domain.
HTML Injection Vectors and End-to-End Exploitation
HTML injection arises in two ways: user-typed raw HTML that is parsed and rendered, and copy-paste of HTML elements into content-editable fields. Browser clipboard APIs sanitize XSS but leave ID and name attributes untouched. The team manually discovered 187 HTML injection vulnerabilities across wikis, webmail, forums, editors, RSS, social media, and chatbots. Combining these with Hawk’s gadgets yielded 12 end-to-end exploits — 11 leading to cross-site scripting and one to CSRF. Affected applications include JupyterLab/Notebook and Canvas LMS. In JupyterLab, the markdown preview accepted raw HTML tags; Hawk’s gadget in MathJax (versions 2 and 3) provided the clobbering path to load attacker scripts.
Notable Quotes
“We found 497 zero day exploitable gadgets” Zhengyu Liu · ▶ 21:17
“The ID or name attribute they sometimes slip through the white lists as they don’t seem harmful at all.” Jianjia Yu · ▶ 28:07
“The developer of Jupyter lab and they also confirmed that it is not trivial to mitigate this vulnerability because the ID and name attributes they are assumed to work by a large number of widget libraries.” Jianjia Yu · ▶ 32:59
Key Takeaways
- Hawk automatically detects and exploits DOM clobbering gadgets with a taint-driven constraint solver.
- 497 exploitable gadgets found in top 5,000 sites — Webpack, Astro, MathJax, Google Client API, and others.
- 12 end-to-end exploits confirmed, proving DOM clobbering is a practical supply-chain risk.
About the Speaker(s)
Zhengyu Liu is a Ph.D. student in Computer Science at Johns Hopkins University, advised by Prof. Yinzhi Cao. His research focuses on Web Security, with an emphasis on systematic vulnerability study through automated program analysis techniques, including static/dynamic analysis, and LLM-integrated approaches. His first-author work has been published in top-tier venues such as IEEE S&P 2024 and USENIX Security 2025, and has received the Best Student Paper Award at ICICS 2022. His research has led to the discovery of many zero-day vulnerabilities in widely used software such as Azure CLI, Google Client API Library, and Jupyter Notebook/JupyterLab, resulting in over 30 CVEs in popular open-source projects (>1K Stars in Github) and acknowledgments from Microsoft, Google, Meta, and Ant Group.
Jianjia Yu is a PhD student at Johns Hopkins University. Her research focuses on the security and privacy of web and mobile applications, using program analysis. She received a Distinguished Paper Award at CCS 2023 for her work on browser extension vulnerabilities.