PT-2024-28953 · Npm · @Udecode/Plate-Media
Joan
·
Published
2024-07-15
·
Updated
2024-07-16
·
CVE-2024-40631
CVSS v4.0
8.4
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
@udecode/plate-media versions prior to 36.0.10
Description
The issue affects editors that use
MediaEmbedElement and pass custom urlParsers to the useMediaState hook, potentially allowing XSS if a custom parser permits javascript:, data: or vbscript: URLs to be embedded. Editors not using urlParsers and consuming the url property directly may also be vulnerable if the URL is not sanitized. The default parsers parseTwitterUrl and parseVideoUrl are not affected.Recommendations
For versions prior to 36.0.10, ensure that any custom
urlParsers do not allow javascript:, data: or vbscript: URLs to be returned in the url property of their return values. If url is consumed directly, validate the URL protocol before passing it to the iframe element. Upgrade to version 36.0.10 to resolve the issue, as it only allows HTTP and HTTPS URLs during parsing. If using the url property directly from useMediaState or element, validate the URL yourself, as these properties are not sanitized.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Udecode/Plate-Media