Executive brief
SummerNote is a popular WYSIWYG editor used in web applications to allow users to format and compose rich text content. The Code View function fails to sanitize user input, allowing attackers to inject malicious JavaScript that executes in a user's browser. This can lead to session hijacking, credential theft, or malware distribution affecting any website using the vulnerable editor.
Technical details
SummerNote 0.8.18 through 0.8.20 is vulnerable to reflected and stored cross-site scripting (CWE-79) in the Code View function. The vulnerability arises from insufficient input sanitization when users switch to code editing mode and inject HTML containing JavaScript event handlers (e.g., `<details/open/ontoggle=prompt(origin)>`). The Code View feature accepts and renders arbitrary HTML without stripping or escaping dangerous tags and attributes, allowing injected scripts to execute in the DOM. The attack requires user interaction (clicking Code View) but can be chained with social engineering or stored as persistent XSS if the application saves editor content without sanitization. Patches are available in versions after 0.8.20.
Affected products
- SummerNote SummerNote 0.8.18 through 0.8.20
Timeline
- 2024-06-12: disclosed: Vulnerability disclosed via GitHub issue and OSV advisory
- 2024-06-12: advisory: CVE-2024-37629 and GHSA-cc55-mvqc-g9mg published