Executive brief
CKEditor 4 is a popular rich-text editor used in web applications to allow users to create and edit formatted content. A vulnerability in its clipboard plugin allows an attacker to inject malicious HTML code into the editor by crafting a malformed paste operation, potentially leading to stored cross-site scripting (XSS) attacks if the content is later published or displayed to other users.
Technical details
The vulnerability exists in the CKEditor 4 clipboard plugin and affects all dependent plugins (pastetext, pastetools, widget, uploadwidget, autolink, tableselection). The issue is a cross-site scripting (CWE-79) and code injection (CWE-94) flaw that allows abuse of the paste functionality with malformed HTML. An attacker with network access can craft malformed HTML that, when pasted into the editor, bypasses sanitization and injects arbitrary HTML content. This typically requires user interaction (pasting content) but can result in persistent XSS if the injected HTML is stored and rendered elsewhere. The vulnerability affects CKEditor 4 versions 4.5.2 and later, and was patched in version 4.16.2.
Affected products
- CKSource CKEditor 4 4.5.2 to 4.16.1
Timeline
- 2021-08-12: disclosed: CVE-2021-32809 published on NVD
- 2021-08-23: disclosed: GHSA-7889-rm5j-hpgg published
- 2021: patched: Fix available in version 4.16.2