Executive brief
CKEditor 4 is a popular rich text editor used in web applications to allow users to create and edit formatted content. The Fake Objects plugin in CKEditor 4, which is used by several dependent plugins, contains a cross-site scripting vulnerability that allows attackers to inject and execute malicious JavaScript code by crafting specially malformed HTML. This could allow attackers to steal user session data, modify page content, or perform actions on behalf of authenticated users.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the Fake Objects plugin (CWE-79) that occurs when processing malformed HTML in fake object elements. The vulnerability allows injection of JavaScript code through specially crafted HTML that bypasses the plugin's sanitization logic. Attack requires user interaction (the victim must be using an affected CKEditor 4 plugin instance with user input) and network access to a vulnerable application. An attacker can execute arbitrary JavaScript in the context of the editor user's browser, potentially accessing sensitive data or performing unauthorized actions. The vulnerability affects CKEditor 4 versions prior to 4.16.2, which was released as a patch in August 2021.
Affected products
- CKSource CKEditor 4 < 4.16.2
Timeline
- 2021-08-12: disclosed
- 2021-08-23: patched: Version 4.16.2 released