Executive brief
Angular Redactor is an npm package that provides a rich-text editor component for Angular applications. When HTML content mode is enabled, the editor fails to properly sanitize user input, allowing attackers to inject malicious JavaScript code (XSS) that executes in browsers of users who view the affected content. This can lead to account compromise, credential theft, or malware distribution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Imperavi Redactor 3 as exposed through the Angular Redactor wrapper. The vulnerability exists when HTML content mode is enabled, allowing injection via img element onerror attributes and similar HTML event handlers. The attack is network-accessible and requires no authentication, though it does require user interaction (viewing/editing content). An attacker can inject JavaScript that executes in the context of the victim's browser session, potentially leading to session hijacking or data exfiltration. The vulnerability affects Angular Redactor up to version 1.1.6; a patch or workaround may be available in newer versions.
Affected products
- Imperavi Redactor 3
- TylerGarlick angular-redactor up to 1.1.6
Timeline
- 2018-07-05: disclosed
- 2022-05-14: advisory