Executive brief
CKEditor 4 is a rich-text HTML editor widely used in content management systems and web applications to allow users to create and edit formatted content. A cross-site scripting (XSS) vulnerability in its HTML processor allows attackers to inject malicious scripts through specially crafted "protected" comments, potentially compromising user sessions, stealing data, or redirecting users to malicious sites.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in CKEditor 4's HTML Data Processor component. The vulnerability exists in versions before 4.14.0 and is triggered when processing specially crafted "protected" comments using the cke_protected syntax. An attacker can inject arbitrary JavaScript code that will execute in the context of the user's browser with access to the same origin. The attack requires user interaction (the user must load a document containing the malicious payload), but does not require authentication. The vulnerability was patched in version 4.14.0.
Affected products
- CKEditor CKEditor 4 before 4.14.0
Timeline
- 2020-03-07: disclosed: Initial disclosure on NVD
- 2020: patched: Fixed in CKEditor 4.14.0
- 2021-05-07: advisory: GHSA-vcjf-mgcg-jxjq published