PT-2022-20587 · Cksource · Ckeditor 5

Mgsypublished · Published 2022-08-03 · Updated 2022-08-09 · CVE-2022-31175

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions prior to 35.0.1

Description A cross-site scripting issue has been discovered in CKEditor 5, affecting three optional packages: @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, and @ckeditor/ckeditor5-html-embed. The vulnerability allows triggering JavaScript code after fulfilling specific conditions, including using one of the affected packages, destroying the editor instance, and initializing the editor on an element other than <textarea>. The root cause is a mechanism responsible for updating the source element with markup from the CKEditor 5 data pipeline after destroying the editor. This issue might affect a small percentage of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support, or HTML embed features.

Recommendations For versions prior to 35.0.1, update to version 35.0.1 to resolve the issue. As a temporary workaround, consider avoiding the use of the affected packages @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, and @ckeditor/ckeditor5-html-embed until the update is applied. Restrict access to configurations that allow unsafe markup inside the editor for ckeditor5-html-support and ckeditor5-html-embed packages to minimize the risk of exploitation. Avoid initializing the editor on elements other than <textarea> and refrain from destroying the editor instance unless necessary, until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31175

GHSA-42WQ-RCH8-6F6J

Affected Products

Ckeditor 5

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31175.json · Exploit
• https://ckeditor.com/docs/ckeditor5/latest/features/markdown.html · Vendor Advisory
• https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-42wq-rch8-6f6j · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31175 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175 · Vendor Advisory
• https://ckeditor.com/docs/ckeditor5/latest/features/general-html-support.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31175 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31175 · Security Note
• https://github.com/ckeditor/ckeditor5 · Note
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-42wq-rch8-6f6j · Note
• https://t.me/cibsecurity/47512 · Telegram Post