Junglewise Threat Intelligence

CVE-2022-21802: GrapesJS cross-site scripting in Selector Manager

CVE-2022-21802 · Severity: low · CVSS 3.1 · Published 2022-07-26

Vendors: npm.

Executive brief

GrapesJS is a popular open-source web builder framework used to create email templates and web layouts without coding. The Selector Manager component, which handles CSS class management, fails to properly sanitize user input, allowing attackers to inject malicious scripts. An attacker can craft a malicious class name that executes JavaScript in the browser of anyone viewing a project, potentially stealing session cookies or performing unauthorized actions.

Technical details

This is a DOM-based cross-site scripting (XSS) vulnerability in GrapesJS's Selector Manager, classified as CWE-79. The root cause is improper sanitization of class names when rendering in the Selector Manager views. The vulnerable component directly interpolates user-supplied class names into HTML templates without escaping special characters, allowing injection of JavaScript payloads. The fix, applied in commit 13e85d15, introduces a sanitized HTML template helper to escape malicious content. No authentication is required for exploitation, but user interaction is needed (a user must view a malicious project). The vulnerability affects all versions prior to 0.19.5. Snyk indicates a proof-of-concept exists.

Affected products

  • GrapesJS grapesjs <0.19.5

Timeline

  • 2022-06-27: disclosed: Vulnerability discovered and patched in commit 13e85d15
  • 2022-07-13: patched: Release v0.19.5 published with XSS fix
  • 2022-07-25: advisory: CVE-2022-21802 published by NVD
  • 2022-07-26: advisory: GitHub Security Advisory GHSA-589f-c66p-hxr4 published

References