PT-2024-30564 · Ckeditor4+3 · Ckeditor4+3

Jiasheng He · Published 2024-08-21 · Updated 2024-08-23 · CVE-2024-43407

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor4 versions prior to 4.25.0-lts

Description A potential vulnerability has been discovered in the CKEditor 4 Code Snippet GeSHi plugin, allowing a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library. The GeSHi library, included as a vendor dependency in CKEditor 4 source files, is no longer actively maintained, and its continued use poses potential security risks. An attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server.

Recommendations To mitigate the risks, upgrade to version 4.25.0-lts or later, which removes the GeSHi library as a dependency. For integrators who still want to use the GeSHi syntax highlighter, manually add the library, but be aware of the potential security vulnerabilities associated with its use. As a temporary workaround, consider disabling the GeSHi syntax highlighter until a patch is available. Restrict access to the vulnerable Code Snippet GeSHi plugin to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43407

GHSA-7R32-VFJ5-C2JV

Affected Products

Ckeditor4

Debian

Geshi

Php

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43407.json · Exploit
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7r32-vfj5-c2jv · Vendor Advisory
• https://github.com/ckeditor/ckeditor4/commit/951e7d75fcbcaa2590b0719fb0bb0dd0539ca6fa · Patch
• https://github.com/ckeditor/ckeditor4/commit/71072c9f7f263329841bd38e7e5309074c82ef94 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-43407 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43407 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7r32-vfj5-c2jv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43407 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43407 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43407 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43407 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43407 · Vendor Advisory
• https://github.com/ckeditor/ckeditor4 · Note
• https://twitter.com/VulmonFeeds/status/1826296935789056501 · Twitter Post
• https://t.me/cvenotify/91952 · Telegram Post