Junglewise Threat Intelligence

CVE-2022-24728: DRUPAL-CORE-2022-005 - The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has released [a security

CVE-2022-24728 · Severity: low · CVSS 3.1 · Published 2022-03-16

Technologies: ckeditor4 (npm). Vendors: Packagist, npm.

Executive brief

CKEditor 4 is a rich text editor used in web applications to allow users to create and edit formatted content. A vulnerability in its HTML sanitization logic allowed attackers to inject specially crafted HTML code that bypassed security filters and executed arbitrary JavaScript in the user's browser. This could lead to account compromise, theft of sensitive data, or session hijacking if exploited against authenticated users.

Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw in CKEditor 4's core HTML processing module affecting content sanitization. An attacker can inject malformed HTML that circumvents the content filtering rules, resulting in arbitrary JavaScript code execution within the editor or the edited document. The attack requires an authenticated user with access to the editor and user interaction (e.g., pasting malicious content or processing attacker-controlled HTML). The vulnerability has been patched in version 4.18.0, which introduced randomized protection keywords and improved the sanitization mechanism to prevent HTML injection bypass techniques. The fix was released on March 16, 2022.

Affected products

  • CKSource CKEditor 4 < 4.18.0

CVE identifiers

  • CVE-2022-24728
  • CVE-2022-24729

Timeline

  • 2022-03-16: disclosed: Vulnerability publicly disclosed via GHSA-4fc4-4p5g-6w89
  • 2022-03-16: patched: Fix released in CKEditor 4.18.0

References

Related threats