Executive brief
KindEditor is a popular open-source web-based text editor used to provide rich-text editing capabilities on websites. A security flaw allows an attacker to trick a logged-in user into performing unintended actions on a website that uses this editor. This could lead to unauthorized data changes or account compromise if an administrative user is targeted.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in KindEditor versions 4.1.x through 4.1.12. The vulnerability is specifically demonstrated in the 'examples/uploadbutton.html' component, which lacks proper request validation. An attacker can exploit this by uploading a malicious HTML file to a server or hosting it externally, then tricking an authenticated user into visiting the link. Because the application does not verify the intent of the request, the attacker can execute actions with the privileges of the victim's active session. The project is currently archived and unmaintained, so no official patch is expected.
Affected products
- kindsoft kindeditor 4.1.0 - 4.1.12
Timeline
- 2021-10-14: disclosed: Issue reported on GitHub and NVD published date.
- 2021-10-18: advisory: GitHub Advisory published.