CVE-2024-34341: Basecamp Trix Editor cross-site scripting in paste handling

CVE-2024-34341 · Severity: low · CVSS 3.1 · Published 2024-05-07

Trix is a rich text editor used by many web applications to allow users to compose and format content. Versions prior to 2.1.1 fail to properly sanitize HTML pasted into the editor, allowing attackers to embed malicious scripts that execute within a user's session. An attacker could steal session cookies, perform actions on behalf of the user, or redirect to phishing sites.

Vendors: Basecamp, Ruby on Rails.

Quick answers

Is CVE-2024-34341 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-34341 being exploited in the wild.
How severe is CVE-2024-34341?
Low severity, with a CVSS score of 3.1, published 7 May 2024.
Which products and versions are affected?
Basecamp Trix Editor 0.9.0 to 1.3.1; 2.0.0 to 2.1.0; Ruby on Rails Rails actiontext 7.0.0.alpha1 to 7.0.8.2; 7.1.0.beta1 to 7.1.3.2.
Is there a fix for CVE-2024-34341?
A patch was published on 2024-05-07: Trix 1.3.2 and 2.1.1 released; Rails 7.0.8.3, 7.0.8.4, 7.1.3.3, 7.1.3.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-34341 attacked?
It is attacked over the network.
Am I affected by CVE-2024-34341?
Check whether you run Basecamp Trix Editor or Ruby on Rails Rails actiontext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Trix Editor contains improper input sanitization when handling pasted content containing HTML markup. The vulnerability (CWE-79 XSS) allows attackers to bypass content filtering through two attack vectors: noscript tag manipulation and data-trix-attachment attributes with embedded JavaScript. The attack is triggered when a user copies crafted HTML from a malicious webpage and pastes it into the editor; no authentication is required and user interaction is necessary. An attacker can execute arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential theft, or malware delivery. Patches were released in versions 1.3.2 and 2.1.1, with Rails' actiontext gem updated to version 7.0.8.3, 7.0.8.4, 7.1.3.3, and 7.1.3.4.

Affected products

  • Basecamp Trix Editor 0.9.0 to 1.3.1; 2.0.0 to 2.1.0
  • Ruby on Rails Rails actiontext 7.0.0.alpha1 to 7.0.8.2; 7.1.0.beta1 to 7.1.3.2

Identifiers

  • CVE-2024-34341
  • GHSA-qjqp-xr96-cj99

Timeline

  • 2024-05-07: disclosed: CVE-2024-34341 and GHSA-qjqp-xr96-cj99 published
  • 2024-05-07: patched: Trix 1.3.2 and 2.1.1 released; Rails 7.0.8.3, 7.0.8.4, 7.1.3.3, 7.1.3.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.