Executive brief
Trix is a rich text editor used by many web applications to allow users to compose and format content. Versions prior to 2.1.1 fail to properly sanitize HTML pasted into the editor, allowing attackers to embed malicious scripts that execute within a user's session. An attacker could steal session cookies, perform actions on behalf of the user, or redirect to phishing sites.
Technical details
Trix Editor contains improper input sanitization when handling pasted content containing HTML markup. The vulnerability (CWE-79 XSS) allows attackers to bypass content filtering through two attack vectors: noscript tag manipulation and data-trix-attachment attributes with embedded JavaScript. The attack is triggered when a user copies crafted HTML from a malicious webpage and pastes it into the editor; no authentication is required and user interaction is necessary. An attacker can execute arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential theft, or malware delivery. Patches were released in versions 1.3.2 and 2.1.1, with Rails' actiontext gem updated to version 7.0.8.3, 7.0.8.4, 7.1.3.3, and 7.1.3.4.
Affected products
- Basecamp Trix Editor 0.9.0 to 1.3.1; 2.0.0 to 2.1.0
- Ruby on Rails Rails actiontext 7.0.0.alpha1 to 7.0.8.2; 7.1.0.beta1 to 7.1.3.2
Timeline
- 2024-05-07: disclosed: CVE-2024-34341 and GHSA-qjqp-xr96-cj99 published
- 2024-05-07: patched: Trix 1.3.2 and 2.1.1 released; Rails 7.0.8.3, 7.0.8.4, 7.1.3.3, 7.1.3.4 released