Executive brief
CKEditor 4 is a widely-used rich text editor embedded in web applications to allow users to compose formatted content. An attacker can trigger a denial-of-service condition by convincing a user to paste specially crafted text into the Styles input field within specific dialogs, causing the application to become unresponsive due to excessive processing time.
Technical details
CKEditor 4 versions before 4.16 are vulnerable to a regular expression denial of service (ReDoS) attack. The vulnerability exists in the Styles input validation logic of the Advanced Tab in the Dialogs plugin, where a vulnerable regex pattern fails to handle crafted input efficiently. An attacker exploiting this would need to trick a user into pasting malicious text into the affected dialog field. Successful exploitation causes the regex engine to enter catastrophic backtracking, consuming CPU resources and making the editor (and potentially the entire page) unresponsive. The issue is fixed in CKEditor 4.16 and later versions.
Affected products
- CKEditor CKEditor 4 before 4.16
Timeline
- 2021-01-26: disclosed
- 2021: patched: Fixed in CKEditor 4.16