Quick answers
- Is CVE-2024-43368 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-43368 being exploited in the wild.
- How severe is CVE-2024-43368?
- Low severity, with a CVSS score of 3.1, published 14 August 2024.
- Which products and versions are affected?
- trix (npm) SEMVER:introduced=0,fixed=2.1.4.
- Is there a fix for CVE-2024-43368?
- Yes. trix (npm): upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-43368 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-43368?
- Check whether you run trix (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- trix (npm): upgrade to 2.1.4 or later
npm install trix@2.1.4
Technical details
This is a cross-site scripting (XSS) vulnerability in Trix versions prior to 2.1.4, exploitable via the copy-and-paste mechanism. The root cause is an incomplete fix to an earlier XSS issue: while the previous patch sanitized attachments with text/html content type, it only checked the dataTransfer object's content type during paste events, not the attachment's own content type. An attacker can construct a malicious dataTransfer with text/html type; Trix will parse the contents and use them to set the attachment element's innerHTML without proper sanitization. The vulnerability requires user interaction (copying and pasting content), but no authentication or special privileges. The attacker can execute arbitrary JavaScript in the victim's browser, compromising confidentiality. Patches are available in version 2.1.4 and later.
Affected products
- Basecamp Trix prior to 2.1.4
Identifiers
- CVE-2024-43368
- GHSA-qm2q-9f3q-2vcv
Timeline
- 2024-08-14: disclosed
- 2024-08-14: patched: version 2.1.4 released