Executive brief
@toast-ui/editor is a popular rich-text editor library used in web applications to allow users to create and edit formatted content. Versions before 2.2.0 contain multiple bypasses in the XSS (cross-site scripting) sanitization logic, allowing attackers to inject and execute arbitrary JavaScript in the browser of anyone viewing content created with the vulnerable library. This could lead to account compromise, session hijacking, or malware distribution.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in @toast-ui/editor's built-in HTML sanitization function. The library implements a custom DOM-based sanitizer that has multiple bypasses, including: improper handling of javascript: URLs via whitelist-based filtering (bypassed with spaces in Firefox), unsafe img attribute replacement that allows onerror event handlers, and potential DOM property override attacks via the [OverrideBuiltins] attribute in certain HTML elements. An attacker can craft malicious HTML/Markdown input that bypasses sanitization, resulting in arbitrary JavaScript execution on the victim's browser when the content is rendered. The attack requires the victim to view the malicious content rendered by the vulnerable editor. The issue was fixed in version 2.2.0 by improving the default HTML sanitizer implementation.
Affected products
- NHN @toast-ui/editor prior to 2.2.0
Timeline
- 2020-01-30: disclosed: Issue reported on GitHub discussing XSS sanitization bypasses
- 2020-06-03: patched: Fix merged in PR #1010 to improve default HTML sanitizer
- 2020-09-03: advisory: GHSA-cr56-66mx-293v published