Executive brief
Trix is a popular rich-text editor used in web applications to allow users to compose formatted content. An attacker can trick a user into copying and pasting malicious code that executes arbitrary JavaScript in the user's browser session, potentially allowing account takeover, session hijacking, or theft of sensitive data.
Technical details
This is a cross-site scripting (XSS) vulnerability in Trix versions prior to 2.1.4, exploitable via the copy-and-paste mechanism. The root cause is an incomplete fix to an earlier XSS issue: while the previous patch sanitized attachments with text/html content type, it only checked the dataTransfer object's content type during paste events, not the attachment's own content type. An attacker can construct a malicious dataTransfer with text/html type; Trix will parse the contents and use them to set the attachment element's innerHTML without proper sanitization. The vulnerability requires user interaction (copying and pasting content), but no authentication or special privileges. The attacker can execute arbitrary JavaScript in the victim's browser, compromising confidentiality. Patches are available in version 2.1.4 and later.
Affected products
- Basecamp Trix prior to 2.1.4
Timeline
- 2024-08-14: disclosed
- 2024-08-14: patched: version 2.1.4 released