CVE-2021-33829: CKEditor 4 cross-site scripting in HTML Data Processor

CVE-2021-33829 · Severity: low · CVSS 3.1 · Published 2021-05-26

CKEditor 4 is a widely-used rich text editor embedded in web applications and content management systems like Drupal to allow users to create and edit formatted content. A vulnerability in its HTML parser allows attackers to inject and execute malicious JavaScript code through specially-crafted HTML comments, potentially compromising user sessions, stealing credentials, or defacing content visible to other users.

Technologies: CKEditor 4, Drupal Core, drupal/core (Packagist). Vendors: CKEditor, Drupal, Packagist.

Quick answers

Is CVE-2021-33829 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-33829 being exploited in the wild.
How severe is CVE-2021-33829?
Low severity, with a CVSS score of 3.1, published 26 May 2021.
Which products and versions are affected?
CKEditor 4 4.14.0 through 4.16.0; Drupal Core 7.0.0 through 7.79, 8.0.0 through 8.9.15, 9.0.0 through 9.0.13, 9.1.0 through 9.1.8; drupal/core (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=8.9.16|ECOSYSTEM:introduced=9.0.0,fixed=9.0.14|ECOSYSTEM:introduced=9.1.0,fixed=9.1.9.
Is there a fix for CVE-2021-33829?
Yes. drupal/core (Packagist): upgrade to 8.9.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-33829 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-33829?
Check whether you run CKEditor 4, Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • drupal/core (Packagist): upgrade to 8.9.16 or later
    composer require drupal/core:^8.9.16

Technical details

A cross-site scripting (XSS) vulnerability exists in the HTML Data Processor component of CKEditor 4 versions 4.14.0 through 4.16.0, caused by improper handling of HTML comment syntax (specifically the sequence `--!>`). An attacker can craft malicious HTML containing executable JavaScript that bypasses the parser's sanitization, allowing code injection if the input is processed by a vulnerable CKEditor instance. The attack requires user interaction (the user must view or process content containing the payload) but does not require authentication. The vulnerability affects CKEditor 4 npm package (fixed in 4.16.1) and Drupal core versions 7.x through 9.x (fixed in 7.80, 8.9.16, 9.0.14, and 9.1.9 respectively). A patch is available.

Affected products

  • CKEditor CKEditor 4 4.14.0 through 4.16.0
  • Drupal Drupal Core 7.0.0 through 7.79, 8.0.0 through 8.9.15, 9.0.0 through 9.0.13, 9.1.0 through 9.1.8

Identifiers

  • CVE-2021-33829
  • DRUPAL-CORE-2021-003
  • GHSA-rgx6-rjj4-c388

Timeline

  • 2021-06-09: disclosed: Vulnerability published on NVD
  • 2021-06-21: advisory: GitHub Security Advisory GHSA-rgx6-rjj4-c388 published
  • 2021-06-21: patched: CKEditor 4.16.1 released with fix; Drupal patches available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.