Executive brief
CKEditor5 is a popular rich text editor used in web applications to allow users to create and edit content. A vulnerability in its editor destruction mechanism could allow an attacker to inject malicious JavaScript code that executes in a user's browser when the editor is destroyed under specific conditions. This could lead to session hijacking, credential theft, or defacement of the web application.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) triggered during the CKEditor5 editor instance destruction process. The root cause lies in a mechanism that updates the source element with markup from the CKEditor5 data pipeline after destroying the editor. The vulnerability requires three preconditions: (1) use of one of the three affected optional packages; for ckeditor5-html-support and ckeditor5-html-embed, additionally requires a configuration allowing unsafe markup; (2) editor initialization on a non-textarea element; (3) explicit editor destruction. The attack vector is network-based and requires user interaction (triggering the specific initialization/destroy sequence). An attacker can execute arbitrary JavaScript in the victim's browser session context. The vulnerability was patched in version 35.0.1.
Affected products
- CKSource @ckeditor/ckeditor5-markdown-gfm < 35.0.1
- CKSource @ckeditor/ckeditor5-html-support < 35.0.1
- CKSource @ckeditor/ckeditor5-html-embed < 35.0.1
Timeline
- 2022-08-03: disclosed: Vulnerability disclosed
- 2022-08-06: advisory: GHSA-42wq-rch8-6f6j published on GitHub advisory database
- 2022: patched: Fix available in version 35.0.1
References
- https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-42wq-rch8-6f6j
- https://ckeditor.com/docs/ckeditor5/latest/features/general-html-support.html
- https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html
- https://ckeditor.com/docs/ckeditor5/latest/features/markdown.html
- https://github.com/ckeditor/ckeditor5