Executive brief
CKEditor 4 is a widely-used rich text editor component embedded in web applications. A regular expression denial-of-service (ReDoS) vulnerability in its Autolink plugin can be triggered when a user pastes specially crafted URL-like text and presses Enter or Space, causing the editor to hang or become unresponsive and degrading application availability.
Technical details
This vulnerability is a Regular Expression Denial of Service (ReDoS) attack vector in CKEditor 4 versions before 4.16.0, classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The Autolink plugin contains a vulnerable regular expression that processes URL-like patterns when users press Enter or Space after pasting text. An attacker can craft malicious URL-like strings that cause catastrophic backtracking in the regex engine, consuming excessive CPU and causing the editor to hang. The attack requires user interaction (pasting and key press) but no authentication. The vulnerability was patched in CKEditor 4.16.0.
Affected products
- CKEditor CKEditor 4 before 4.16.0
Timeline
- 2021-01-26: disclosed: NVD published
- 2021-10-13: advisory: GHSA advisory published
- 2021-10-15: patched: Fixed in CKEditor 4.16.0