Executive brief
Progress Kendo UI's Angular Editor component is a rich text editor used to capture and display user-generated content in web applications. Versions before 1.2.3 fail to sanitize malicious JavaScript in HTML event handlers (such as onerror attributes), allowing an attacker to inject and execute arbitrary code in the browser context of users viewing the edited content, potentially stealing session tokens or performing unauthorized actions.
Technical details
The vulnerability is a reflected/stored cross-site scripting (XSS) flaw in the Kendo Angular Editor component (CWE-79). The editor does not properly sanitize or escape HTML content containing event handler attributes before rendering. An attacker can inject a malicious HTML element such as <img src="" onerror=alert(document.domain)> into the editor, and the event handler executes when the content is displayed. No authentication is required to exploit this—any user able to input content into an editor instance is a potential attacker. The vulnerability affects all versions prior to 1.2.3, which introduced proper content sanitization. The fix ensures event handlers in user-supplied HTML are neutralized before rendering.
Affected products
- Progress Kendo Angular Editor before 1.2.3
Timeline
- 2020-08-11: disclosed