CVE-2024-45613: CKEditor 5 clipboard cross-site scripting

CVE-2024-45613 · Severity: low · CVSS 3.1 · Published 2024-09-25

CKEditor 5 is a popular JavaScript-based rich text editor used to create and edit content on websites. A cross-site scripting vulnerability in the clipboard handling component allows attackers to execute malicious JavaScript in users' browsers if specific editor plugins are enabled (Block Toolbar combined with General HTML Support or HTML Embed). This could lead to session hijacking, credential theft, or defacement of user content.

Technologies: ckeditor5 (npm). Vendors: CKSource, npm.

Quick answers

Is CVE-2024-45613 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-45613 being exploited in the wild.
How severe is CVE-2024-45613?
Low severity, with a CVSS score of 3.1, published 25 September 2024.
Which products and versions are affected?
CKSource Ckeditor5-Clipboard 40.0.0 to 43.1.0; @ckeditor/ckeditor5-clipboard (npm) SEMVER:introduced=40.0.0,fixed=43.1.1; ckeditor5 (npm) SEMVER:introduced=40.0.0,fixed=43.1.1.
Is there a fix for CVE-2024-45613?
Yes. @ckeditor/ckeditor5-clipboard (npm): upgrade to 43.1.1 or later; ckeditor5 (npm): upgrade to 43.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45613 attacked?
It is attacked over the network.
Am I affected by CVE-2024-45613?
Check whether you run CKSource Ckeditor5-Clipboard, @ckeditor/ckeditor5-clipboard (npm) or ckeditor5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @ckeditor/ckeditor5-clipboard (npm): upgrade to 43.1.1 or later
    npm install @ckeditor/ckeditor5-clipboard@43.1.1
  • ckeditor5 (npm): upgrade to 43.1.1 or later
    npm install ckeditor5@43.1.1

Technical details

The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in CKEditor 5's clipboard package that requires user interaction and a specific editor configuration combining the Block Toolbar plugin with either General HTML Support (permitting unsafe markup) or the HTML Embed plugin. An attacker must insert malicious content into the editor, which is then executed as JavaScript in the user's browser. The vulnerability affects versions 40.0.0 through 43.1.0 and has been patched in versions 43.1.1 and 41.3.2. No exploitation in the wild has been reported.

Affected products

  • CKSource CKEditor 5 40.0.0 to 43.1.0
  • CKSource ckeditor5-clipboard 40.0.0 to 43.1.0

Identifiers

  • CVE-2024-45613
  • GHSA-rgg8-g5x8-wr9v

Timeline

  • 2024-09-25: disclosed: GHSA-rgg8-g5x8-wr9v published; CVE-2024-45613 assigned
  • 2024-09-25: patched: Fix available in versions 43.1.1 and 41.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.