CVE-2024-24815: CKEditor4 cross-site scripting in HTML parsing with incorrect CDATA detection

CVE-2024-24815 · Severity: low · CVSS 3.1 · Published 2024-02-07

CKEditor4 is a popular web-based rich text editor used in content management systems and web applications to allow users to create and edit formatted content. A cross-site scripting (XSS) vulnerability in its HTML parsing module allows attackers to inject malicious JavaScript code by exploiting faulty CDATA detection, potentially leading to account compromise, session hijacking, or data theft when the editor is used in full-page mode or with CDATA filtering enabled.

Technologies: ckeditor4 (npm), ckeditor/ckeditor (Packagist). Vendors: npm, Packagist.

Quick answers

Is CVE-2024-24815 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-24815 being exploited in the wild.
How severe is CVE-2024-24815?
Low severity, with a CVSS score of 3.1, published 7 February 2024.
Which products and versions are affected?
ckeditor4 (npm) SEMVER:introduced=0,fixed=4.24.0-lts; ckeditor/ckeditor (Packagist) ECOSYSTEM:introduced=0,fixed=4.24.0.
Is there a fix for CVE-2024-24815?
Yes. ckeditor4 (npm): upgrade to 4.24.0-lts or later; ckeditor/ckeditor (Packagist): upgrade to 4.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-24815 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-24815?
Check whether you run ckeditor4 (npm) or ckeditor/ckeditor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ckeditor4 (npm): upgrade to 4.24.0-lts or later
    npm install ckeditor4@4.24.0-lts
  • ckeditor/ckeditor (Packagist): upgrade to 4.24.0 or later
    composer require ckeditor/ckeditor:^4.24.0

Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw in CKEditor4's core HTML parsing module caused by incorrect CDATA element detection. An attacker can inject malformed HTML content that bypasses the Advanced Content Filtering (ACF) mechanism, allowing arbitrary JavaScript execution. The vulnerability affects all editor instances with full-page editing mode enabled or CDATA elements enabled in ACF configuration (which includes script and style elements by default). Exploitation requires user interaction (e.g., pasting or loading the malicious content into the editor), but does not require authentication. The vulnerability has been patched in version 4.24.0-lts (or 4.24.0 for Composer).

Affected products

  • CKSource CKEditor4 < 4.24.0-lts

Identifiers

  • CVE-2024-24815
  • GHSA-fq6h-4g8v-qqvm

Timeline

  • 2024-02-07: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-fq6h-4g8v-qqvm
  • 2024-02-07: patched: Fix available in version 4.24.0-lts for npm and 4.24.0 for Composer

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.