Is CVE-2019-19935 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-19935 being exploited in the wild.

How severe is CVE-2019-19935?

Low severity, with a CVSS score of 3.1, published 10 February 2022.

Which products and versions are affected?

Froala Editor before 3.2.3; froala-editor (npm) SEMVER:introduced=0,fixed=3.2.3.

Is there a fix for CVE-2019-19935?

Yes. froala-editor (npm): upgrade to 3.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-19935 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-19935?

Check whether you run Froala Editor or froala-editor (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-19935: Froala Editor DOM-based cross-site scripting

CVE-2019-19935 · Severity: low · CVSS 3.1 · Published 2022-02-10

Froala Editor is a JavaScript-based rich text editor widely used in web applications to enable users to edit and format HTML content. A DOM-based cross-site scripting vulnerability allows attackers to execute arbitrary JavaScript code in a victim's browser session by injecting malicious HTML into the editor. This could lead to session hijacking, credential theft, or manipulation of application data.

Technologies: Froala Editor, froala-editor (npm). Vendors: Froala, npm.

Quick answers

Is CVE-2019-19935 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-19935 being exploited in the wild.
How severe is CVE-2019-19935?: Low severity, with a CVSS score of 3.1, published 10 February 2022.
Which products and versions are affected?: Froala Editor before 3.2.3; froala-editor (npm) SEMVER:introduced=0,fixed=3.2.3.
Is there a fix for CVE-2019-19935?: Yes. froala-editor (npm): upgrade to 3.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-19935 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-19935?: Check whether you run Froala Editor or froala-editor (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

froala-editor (npm): upgrade to 3.2.3 or later
```
npm install froala-editor@3.2.3
```

Technical details

The vulnerability is a DOM-based cross-site scripting (CWE-79) caused by incomplete HTML sanitization in Froala Editor versions before 3.2.3. While the editor blocks common XSS vectors like script tags and event handlers on standard elements, it fails to filter the iframe tag with the srcdoc attribute, which can execute arbitrary JavaScript in the page's origin. An attacker who can control editor content (either through user-supplied input, untrusted data from an API, or collaborative editing) can inject a payload like <iframe srcdoc="<img src=x onerror=alert(document.domain)>"></iframe> to achieve code execution. The attack requires no authentication but does require either self-XSS (user interaction/self-editing) or the ability to load untrusted data into the editor. Patches are available in version 3.2.3 and later.

Affected products

Froala Editor before 3.2.3

Identifiers

CVE-2019-19935
GHSA-h236-g5gh-vq6c

Timeline

2020-07-03: disclosed: Compass Security published vulnerability report
2020: patched: Fixed in version 3.2.3

References

https://blog.compass-security.com/2020/07/yet-another-froala-0-day-xss

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.