Executive brief
CKEditor is a widely-used rich-text editor component embedded in web applications and content management systems. This vulnerability allows an attacker to execute malicious JavaScript code (XSS) in a user's browser if the user can be tricked into switching to source mode, pasting attacker-supplied HTML, and then switching back to normal editing mode. While the attack requires user interaction and is considered unlikely, successful exploitation could lead to session hijacking, data theft, or malware distribution.
Technical details
This is a cross-site scripting (XSS) vulnerability in CKEditor 4's HTML parser. The root cause is insufficient sanitization of HTML content when pasted into source mode. An attacker can craft specially malicious HTML that bypasses the editor's XSS defenses when pasted into the source view. The attack requires: (1) network access to a web application using vulnerable CKEditor, (2) social engineering to convince a user to switch to source mode, paste the malicious HTML, and return to WYSIWYG mode, and (3) user interaction throughout. If successful, arbitrary JavaScript executes in the victim's browser with access to the page's DOM and user data. The vulnerability was fixed in CKEditor 4.11.0 (released November 2018) and patched versions of TYPO3 CMS.
Affected products
- CKSource CKEditor 4 before 4.11.0
- TYPO3 CMS Core 8.0.0 to 8.7.20; 9.0.0 to 9.5.1
- TYPO3 CMS 8.0.0 to 8.7.20; 9.0.0 to 9.5.1
Timeline
- 2018-11-21: disclosed: GHSA-g68x-vvqq-pvw3 published
- 2018-11: patched: CKEditor 4.11.0 released with fix; TYPO3 CMS Core 8.7.21 and 9.5.2 released