PT-2024-30531 · Unknown · Trix Editor

Thwin_Htet · Published 2024-05-07 · Updated 2024-08-15 · CVE-2024-43368

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trix editor versions prior to 2.1.4

Description The issue is related to a bypass of a previous fix, allowing an attacker to execute arbitrary JavaScript code within the context of the user's session when pasting malicious code. This occurs because the Trix editor only checks the content type on the paste event's dataTransfer object and uses the attachment content to set the attachment element's innerHTML, even if the attachment itself doesn't have a text/html content type. An attacker could trick a user into copying and pasting malicious code, potentially leading to unauthorized actions or sensitive information disclosure.

Recommendations To resolve the issue, users should upgrade to Trix editor version 2.1.4 or later, which incorporates proper sanitization of input from copied content. Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts can significantly mitigate the risk of such vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem. If affected users can disallow browsers that don't support a Content Security Policy, this would be an effective workaround for this and all XSS vulnerabilities.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43368

GHSA-QJQP-XR96-CJ99

GHSA-QM2Q-9F3Q-2VCV

Affected Products

Trix Editor

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43368.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-34341.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43368 · Security Note
• https://osv.dev/vulnerability/GHSA-qm2q-9f3q-2vcv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43368 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjqp-xr96-cj99 · Vendor Advisory
• https://github.com/rails/rails/commit/260cb392fc1ee91d0b749cff08d1c8d54b230bd3 · Note
• https://github.com/rails/rails/commit/73fac32511eefdd45d8f00fecc2b8cc5408ea6d5 · Note
• https://github.com/rails/rails/commit/07e6c88cc4defe6f6b8d28e79eb13a518e15b14c · Note
• https://github.com/basecamp/trix · Note
• https://github.com/basecamp/trix/pull/1149 · Note
• https://github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad · Note
• https://github.com/basecamp/trix/releases/tag/v2.1.1 · Note
• https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99 · Note