Executive brief
CKEditor 4 is a widely-used rich text editor embedded in web applications and content management systems like Drupal to allow users to create and edit formatted content. A vulnerability in its HTML parser allows attackers to inject and execute malicious JavaScript code through specially-crafted HTML comments, potentially compromising user sessions, stealing credentials, or defacing content visible to other users.
Technical details
A cross-site scripting (XSS) vulnerability exists in the HTML Data Processor component of CKEditor 4 versions 4.14.0 through 4.16.0, caused by improper handling of HTML comment syntax (specifically the sequence `--!>`). An attacker can craft malicious HTML containing executable JavaScript that bypasses the parser's sanitization, allowing code injection if the input is processed by a vulnerable CKEditor instance. The attack requires user interaction (the user must view or process content containing the payload) but does not require authentication. The vulnerability affects CKEditor 4 npm package (fixed in 4.16.1) and Drupal core versions 7.x through 9.x (fixed in 7.80, 8.9.16, 9.0.14, and 9.1.9 respectively). A patch is available.
Affected products
- CKEditor CKEditor 4 4.14.0 through 4.16.0
- Drupal Drupal Core 7.0.0 through 7.79, 8.0.0 through 8.9.15, 9.0.0 through 9.0.13, 9.1.0 through 9.1.8
Timeline
- 2021-06-09: disclosed: Vulnerability published on NVD
- 2021-06-21: advisory: GitHub Security Advisory GHSA-rgx6-rjj4-c388 published
- 2021-06-21: patched: CKEditor 4.16.1 released with fix; Drupal patches available