PT-2021-23564 · Unknown · Kindeditor

Cyber-Word · Published 2021-10-14 · Updated 2021-10-19 · CVE-2021-42228

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KindEditor version 4.1.x

Description A Cross Site Request Forgery (CSRF) issue exists, allowing attackers to trick users into clicking malicious links by uploading an HTML file containing CSRF code on a website using the editor. This can be done by first uploading the malicious file, then using the authority of the website to deceive users into clicking the link. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For KindEditor version 4.1.x, as a temporary workaround, consider restricting access to the examples/uploadbutton.html endpoint until a patch is available. Avoid using the editor to upload HTML files containing potentially malicious code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-42228

GHSA-3WW4-CP53-6G2X

Affected Products

Kindeditor

References · 6

• 🔥 https://github.com/kindsoft/kindeditor/issues/337 · Exploit
• https://osv.dev/vulnerability/GHSA-3ww4-cp53-6g2x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42228 · Security Note
• https://github.com/kindsoft/kindeditor · Note
• https://t.me/cibsecurity/30586 · Telegram Post