XSS vulnerability CVE-2023-41592 still in version 4.2.2

[jurajvalkucak]

CVE-2023-41592 Customize froala-editor : 4.2.2 Issue CVE-2023-41592 CVE-2023-42426 Severity CVE CVSS 35.4 Sonatype CVSS 36.1 Weakness CVE CWE79 Source National Vulnerability Database Categories Data Description from CVE Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.

Explanation The froala-editor package is vulnerable to Cross-Site Scripting (XSS). When using the 'Insert Image' component to add hyperlinks to an exiting image in a FroalaEditor instance, the editor does not properly sanitize the href attribute (link value) provided for the tag. An attacker can exploit this vulnerability by providing a crafted hyperlink code which, if saved on the backend of a website using Froala Editor, can result in stored XSS attacks when rendered in a visitor's web browser.

Note: While researching CVE-2023-41592, the Sonatype Security research team also accounted for the issue which was later assigned CVE-2023-42426. Given the identical nature of the vulnerability and the attack vector, we are treating these CVEs identical. As such, information for both CVE-2023-41592 and CVE-2023-42426 is captured here.

Given the following Advisory Deviation Notice, we consider CVE-2023-41592 to also cover CVE-2023-43263.

Advisory Deviation Notice: The Sonatype Security Research team tested the provided PoC exploits (see "Additional Resources") against Froala Editor versions <4.0.1 and >=4.1.2 (4.2.1 being the latest version at the time of our Deep Dive research) and observed the vulnerability could be reproduced in these versions. As such, versions prior to 4.x are also vulnerable, contrary to what is stated in this advisory. Additionally, a fixed version is not available at the time of our research.

Detection The application is vulnerable by using this component.

Recommendation There is no non-vulnerable upgrade path for this component/package. We recommend investigating alternative components or a potential mitigating control.

Version Affected [1.2.0,4.3.0] Root Cause froala-editor-4.2.2.tgzpackage/js/froala_editor.min.js(,) froala-editor-4.2.2.tgzpackage/js/froala_editor.pkgd.min.js(,) froala-editor-4.2.2.tgzpackage/index.d.ts[4.1.0, ) Advisories Attackhttps://github.com/froala/wysiwyg-editor/issues/4678 Evidencehttps://www.youtube.com/watch?v=Me33Dx1_XqQ Third Partyhttps://hacker.soarescorp.com/cve/2023-41592/ CVSS Details CVE CVSS 35.4 CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N