Executive brief
simditor is a JavaScript-based rich text editor commonly used in web applications to allow users to create and edit formatted content. The library failed to sanitize user input before rendering it with innerHTML, allowing attackers to inject malicious JavaScript code that executes in the context of other users' browsers, potentially stealing session cookies, credentials, or modifying page content.
Technical details
simditor versions prior to 2.3.22 contain a stored/reflected Cross-Site Scripting (XSS) vulnerability in the HTML rendering logic due to unsanitized use of innerHTML (CWE-79). The vulnerable component fails to filter user-supplied input before inserting it into the DOM, allowing attackers to embed arbitrary JavaScript that executes with the privileges of authenticated users viewing the content. No authentication is required if the XSS payload is embedded in shared or public content; user interaction is limited to viewing or editing content within the application. The fix, implemented in version 2.3.22 and later, integrates the DOMPurify library to sanitize HTML before rendering.
Affected products
- mycolorway simditor prior to 2.3.22
Timeline
- 2019-05-14: disclosed
- 2018-11-09: patched: DOMPurify integration committed; version 2.3.22 released