PT-2022-11356 · Vditor · Vditor

Published 2022-01-23 · Updated 2022-01-28 · CVE-2021-4103

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions vditor versions prior to 1.0.34

Description The issue is related to Cross-site Scripting (XSS) - Stored, where vditor does not filter user input in SVG events, leading to XSS. This can be exploited using malicious SVG code, such as an animate tag with an onbegin attribute set to execute arbitrary JavaScript, for example: <svg><animate onbegin=alert(11) attributeName=x dur=1s>.

Recommendations For versions prior to 1.0.34, update to version 1.0.34 or later to resolve the issue. As a temporary workaround, consider disabling the use of SVG events in vditor until a patch is available. Restrict access to the vditor module to minimize the risk of exploitation. Avoid using unfiltered user input in SVG events until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-4103

GHSA-CXM3-V4MV-6MH8

Affected Products

Vditor

References · 9

• 🔥 https://huntr.dev/bounties/67b980af-7357-4879-9448-a926c6474225 · Exploit
• https://github.com/vanessa219/vditor/commit/8d4d0889dd72b2f839e93a49db3da3a370416c7d · Patch
• https://osv.dev/vulnerability/GHSA-cxm3-v4mv-6mh8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4103 · Security Note
• https://github.com/vanessa219/vditor · Note
• https://github.com/Vanessa219/vditor/issues/1133 · Note
• https://t.me/cibsecurity/36092 · Telegram Post
• https://t.me/cvenotify/25918 · Telegram Post