PT-2018-12293 · Progress · Kendo Ui Editor

M. Tomaselli · Published 2018-09-28 · Updated 2019-08-01 · CVE-2018-14037

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Progress Kendo UI Editor version 2018.1.221

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor due to the editorNS.Serializer to toEditableHtml function in kendo.all.min.js. When a victim accesses the editor, the payload is executed. If the payload is reflected in other resources relying on the editor's sanitization, the JavaScript payload is executed in the application's context, potentially allowing attackers to take over user sessions.

Recommendations For Progress Kendo UI Editor version 2018.1.221, consider disabling the toEditableHtml function in kendo.all.min.js as a temporary workaround until a patch is available. Restrict access to the WYSIWYG editor to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-14037

Affected Products

Kendo Ui Editor

References · 6

• 🔥 https://sec-consult.com/en/blog/advisories/stored-cross-site-scripting-in-kendo-ui-editor-cve-2018-14037 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14037 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14037 · Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Sep/49 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14037 · Note
• http://seclists.org/fulldisclosure/2018/Sep/50 · Note