Executive brief
CKEditor4 is a widely-used rich-text editor component for web applications. A cross-site scripting (XSS) vulnerability in certain sample files shipped with CKEditor4 allows attackers to execute malicious JavaScript code in users' browsers if those samples are deployed in production environments. This could lead to account compromise, session hijacking, or malware distribution.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in CKEditor4 sample files that use the preview feature, specifically in samples/old/**/*.html and plugins/[plugin name]/samples/**/*.html. The root cause is a misconfigured preview feature in these samples that does not properly sanitize or restrict JavaScript execution. An attacker can exploit this by crafting malicious input that, when previewed, executes arbitrary JavaScript in the victim's browser context. This requires user interaction (opening/previewing the payload) but does not require authentication. The vulnerability only affects integrators who deploy these sample files directly in production code. A patch is available in CKEditor4 4.24.0-lts and later versions.
Affected products
- CKSource CKEditor4 < 4.24.0-lts
Timeline
- 2024-02-07: disclosed
- 2024-02-07: patched: Fix available in version 4.24.0-lts