Executive brief
CKEditor's Enhanced Image plugin is used to display and manage images within a rich text editor. An attacker can inject malicious scripts through specially crafted image elements, which would execute in the browser of any user viewing the content, potentially allowing account takeover or data theft from authenticated users.
Technical details
The vulnerability is a stored/reflected cross-site scripting (XSS) flaw in the Enhanced Image (image2) plugin for CKEditor versions 4.5.10 through 4.9.1. The plugin fails to properly sanitize or validate IMG element attributes, allowing remote attackers to inject arbitrary JavaScript that executes in the context of a viewer's browser. No authentication is required to craft a malicious image element, though the attacker must have a way to inject it into the editor or saved content. The vulnerability was patched in CKEditor 4.9.2 and in Drupal 8.4.7 and 8.5.2, which bundle CKEditor.
Affected products
- CKEditor CKEditor 4.5.10 through 4.9.1
- Drupal Drupal 8.0 through 8.4.6, 8.5.0 through 8.5.1
Timeline
- 2018-04-19: disclosed: CVE-2018-9861 published
- 2018-04-18: patched: Drupal 8.4.7 and 8.5.2 released with fix
- 2022-05-14: advisory: GHSA-g78h-pf65-46rv published