CVE-2022-31175: CKEditor5 cross-site scripting in editor destroy process

CVE-2022-31175 · Severity: low · CVSS 3.1 · Published 2022-08-06

CKEditor5 is a popular rich text editor used in web applications to allow users to create and edit content. A vulnerability in its editor destruction mechanism could allow an attacker to inject malicious JavaScript code that executes in a user's browser when the editor is destroyed under specific conditions. This could lead to session hijacking, credential theft, or defacement of the web application.

Vendors: CKSource, npm.

Quick answers

Is CVE-2022-31175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-31175 being exploited in the wild.
How severe is CVE-2022-31175?
Low severity, with a CVSS score of 3.1, published 6 August 2022.
Which products and versions are affected?
@ckeditor/ckeditor5-html-embed (npm) SEMVER:introduced=0,fixed=35.0.1; @ckeditor/ckeditor5-html-support (npm) SEMVER:introduced=0,fixed=35.0.1; @ckeditor/ckeditor5-markdown-gfm (npm) SEMVER:introduced=0,fixed=35.0.1.
Is there a fix for CVE-2022-31175?
Yes. @ckeditor/ckeditor5-html-embed (npm): upgrade to 35.0.1 or later; @ckeditor/ckeditor5-html-support (npm): upgrade to 35.0.1 or later; @ckeditor/ckeditor5-markdown-gfm (npm): upgrade to 35.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31175 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-31175?
Check whether you run CKSource CKEditor 5 HTML Embed, CKSource CKEditor 5 HTML Support, CKSource CKEditor 5 Markdown GFM or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @ckeditor/ckeditor5-html-embed (npm): upgrade to 35.0.1 or later
    npm install @ckeditor/ckeditor5-html-embed@35.0.1
  • @ckeditor/ckeditor5-html-support (npm): upgrade to 35.0.1 or later
    npm install @ckeditor/ckeditor5-html-support@35.0.1
  • @ckeditor/ckeditor5-markdown-gfm (npm): upgrade to 35.0.1 or later
    npm install @ckeditor/ckeditor5-markdown-gfm@35.0.1

Technical details

This is a cross-site scripting (XSS) vulnerability (CWE-79) triggered during the CKEditor5 editor instance destruction process. The root cause lies in a mechanism that updates the source element with markup from the CKEditor5 data pipeline after destroying the editor. The vulnerability requires three preconditions: (1) use of one of the three affected optional packages; for ckeditor5-html-support and ckeditor5-html-embed, additionally requires a configuration allowing unsafe markup; (2) editor initialization on a non-textarea element; (3) explicit editor destruction. The attack vector is network-based and requires user interaction (triggering the specific initialization/destroy sequence). An attacker can execute arbitrary JavaScript in the victim's browser session context. The vulnerability was patched in version 35.0.1.

Affected products

  • CKSource @ckeditor/ckeditor5-markdown-gfm < 35.0.1
  • CKSource @ckeditor/ckeditor5-html-support < 35.0.1
  • CKSource @ckeditor/ckeditor5-html-embed < 35.0.1

Identifiers

  • CVE-2022-31175
  • GHSA-42wq-rch8-6f6j

Timeline

  • 2022-08-03: disclosed: Vulnerability disclosed
  • 2022-08-06: advisory: GHSA-42wq-rch8-6f6j published on GitHub advisory database
  • 2022: patched: Fix available in version 35.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.