Executive brief
Plate Media is a JavaScript library used to embed media content (videos, tweets) in web editors. When developers use custom URL parsers or directly consume unvalidated URLs from the library, attackers can inject malicious JavaScript code (via javascript:, data:, or vbscript: URLs) that executes in users' browsers. This could allow attackers to steal session tokens, modify page content, or perform actions on behalf of users.
Technical details
The vulnerability is a Cross-Site Scripting (XSS) flaw in @udecode/plate-media's MediaEmbedElement component. The root cause is insufficient validation of URLs passed to the useMediaState hook when custom urlParsers are provided, or when the url/unsafeUrl properties are consumed directly without sanitization. An attacker with the ability to control the URL input (e.g., via a compromised data source or user input) can inject javascript:, data:, or vbscript: protocol URLs that execute arbitrary code when rendered in an iframe. The vulnerability requires low privileges and network access but no user interaction. Patch 36.0.10 restricts the embed property to HTTP/HTTPS URLs only and renames url to unsafeUrl to signal that direct URL consumption requires developer validation.
Affected products
- Udecode Plate Media <36.0.10
Timeline
- 2024-07-15: disclosed
- 2024-07-15: patched: Version 36.0.10 released