CVE-2024-45613: CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package
Impact During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration.
This vulnerability affects only installations where the editor configuration meets the following criteria:
1. The Block Toolbar plugin is enabled. 1. One of the following plugins is also enabled: - General HTML Support with a configuration that permits unsafe markup. - HTML Embed.
Patches The problem has been recognized and patched. The fix will be available in version 43.1.1 (and above), and explicitly in version 41.3.2.
Workarounds It's highly recommended to update to the version 43.1.1 or higher. However, if the update is not an option, we recommend disabling the block toolbar plugin.
For more information Email us at security@cksource.com if you have any questions or comments about this advisory.
Other sources
CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.
— MITRE
CKEditor 5 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the clipboard package. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45613?
The severity of CVE-2024-45613 is classified as high due to its potential for unauthorized JavaScript code execution.
How do I fix CVE-2024-45613?
To fix CVE-2024-45613, upgrade to version 43.1.1 or later of the CKEditor 5 clipboard package.
What software is affected by CVE-2024-45613?
CVE-2024-45613 affects the CKEditor 5 clipboard package versions between 40.0.0 and 43.1.1.
What type of vulnerability is CVE-2024-45613?
CVE-2024-45613 is a Cross-Site Scripting (XSS) vulnerability.
Can CVE-2024-45613 be exploited by a user?
Yes, CVE-2024-45613 can be exploited through specific user actions that trigger the vulnerability.