Executive brief
Froala Editor is a JavaScript-based rich text editor widely used in web applications to enable users to edit and format HTML content. A DOM-based cross-site scripting vulnerability allows attackers to execute arbitrary JavaScript code in a victim's browser session by injecting malicious HTML into the editor. This could lead to session hijacking, credential theft, or manipulation of application data.
Technical details
The vulnerability is a DOM-based cross-site scripting (CWE-79) caused by incomplete HTML sanitization in Froala Editor versions before 3.2.3. While the editor blocks common XSS vectors like script tags and event handlers on standard elements, it fails to filter the iframe tag with the srcdoc attribute, which can execute arbitrary JavaScript in the page's origin. An attacker who can control editor content (either through user-supplied input, untrusted data from an API, or collaborative editing) can inject a payload like <iframe srcdoc="<img src=x onerror=alert(document.domain)>"></iframe> to achieve code execution. The attack requires no authentication but does require either self-XSS (user interaction/self-editing) or the ability to load untrusted data into the editor. Patches are available in version 3.2.3 and later.
Affected products
- Froala Editor before 3.2.3
Timeline
- 2020-07-03: disclosed: Compass Security published vulnerability report
- 2020: patched: Fixed in version 3.2.3