Executive brief
CKEditor 4 is a widely-used rich text editor embedded in web applications to allow users to create and format content. A reflected cross-site scripting vulnerability in the bundled GeSHi syntax highlighter plugin allows attackers to inject malicious scripts that execute in a victim's browser when they visit a crafted URL, potentially compromising user sessions or stealing sensitive data.
Technical details
A reflected XSS vulnerability exists in the Code Snippet GeSHi plugin included with CKEditor 4, stemming from improper handling of input in the GeSHi syntax highlighter library (an unmaintained third-party dependency). An attacker can craft a malicious request to the GeSHi library hosted on a PHP web server to execute arbitrary JavaScript in the victim's browser. The attack requires user interaction (victim clicking a malicious link), but no authentication is needed. The vulnerability affects all CKEditor 4 versions prior to 4.25.0-lts, in which the GeSHi library has been removed entirely. Integrators wishing to continue using GeSHi are advised to source it independently and review its security posture.
Affected products
- CKSource CKEditor 4 before 4.25.0-lts
Timeline
- 2024-08-21: disclosed
- 2024-08-21: patched: Fixed in version 4.25.0-lts