Executive brief
CKEditor 4 is a rich text editor used in web applications to allow users to create and edit content. A vulnerability in its Advanced Content Filter (ACF) component allows an attacker to bypass content sanitization by injecting malformed HTML, enabling execution of arbitrary JavaScript code in users' browsers. This could lead to account takeover, credential theft, or malware distribution.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in CKEditor 4's Advanced Content Filter module (CWE-79). The root cause is insufficient validation of malformed HTML input, allowing attackers to bypass the sanitization logic designed to prevent script injection. An attacker with the ability to provide content to the editor (typically authenticated users or those with content-upload privileges) can craft malicious HTML that, when processed by ACF, is not properly sanitized and results in JavaScript execution in the context of the user's browser. The vulnerability affects all versions of CKEditor 4 prior to 4.17.0, and is patched in version 4.17.0 and later.
Affected products
- CKSource CKEditor 4 < 4.17.0
Timeline
- 2021-11-17: disclosed
- 2021-11-17: patched: Patched in version 4.17.0