Quick answers
- Is CVE-2024-32472 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-32472 being exploited in the wild.
- How severe is CVE-2024-32472?
- Low severity, with a CVSS score of 3.1, published 17 April 2024.
- Which products and versions are affected?
- Excalidraw 0.16.0 to 0.17.5 (patched in 0.16.4 and 0.17.6).
- Is there a fix for CVE-2024-32472?
- A patch was published on 2024-04-17: Fixed in versions 0.16.4 and 0.17.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-32472 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-32472?
- Check whether you run Excalidraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability stems from improper sanitization in Excalidraw's web embed component when handling iframe srcdoc attributes and HTML attributes. An attacker can craft a malicious embed URL containing script tags that bypass sanitization filters, allowing arbitrary JavaScript execution in the same origin. The root cause involved rendering untrusted strings directly as iframe srcdoc content and inadequate attribute-level HTML injection prevention. The attack requires user interaction (inserting an embed into a canvas) but no authentication. Patches were released in versions 0.16.4 and 0.17.6, fixing sanitization logic and restricting the allow-same-origin sandbox flag to only cases that require it.
Affected products
- Excalidraw excalidraw 0.16.0 to 0.17.5 (patched in 0.16.4 and 0.17.6)
Identifiers
- CVE-2024-32472
- GHSA-m64q-4jqh-f72f
Timeline
- 2024-04-17: disclosed: Vulnerability published as GHSA-m64q-4jqh-f72f and CVE-2024-32472
- 2024-04-17: patched: Fixed in versions 0.16.4 and 0.17.6