Security Research
CVE-2020-981 CKEditor 4 XSS: Sanitizer Boundaries in Rich Text Editors
Thinking
2020-05-12
2 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
CKEditor 4’s sanitizer has a gap in handling certain HTML tag-attribute combinations prior to v4.13 — a single crafted HTML snippet is enough to inject Stored XSS into every application that uses CKEditor 4.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd8a37611417e66d499ca94a1c6ac522128fc03f56c6ace972a5fa9ae5602d61843cea9f80489002116d53f74ed50343dc26c5163ce6e86fe12e6a7bfa28f7c6efca0d6486c5beafa170afc321741c29721233ef4ea1542dfc488eeefc9d29c60e77850f8a7c0e29601d35789f177903d868450e7398281987e4c33137a9faa60a03882087ac8239ba7b9eccc1e9ae2bfecdc2df1843ddbd70bf4f695ad0253eb68552c4521aee2d17725511721434b8a584c3f226e999821133979cb9533e5d9057adcc79cc791b99d158a1acb4409246d2747452dfc051ac4b6ce89baf293b9fd165a5dd4eac78b95e8322bca6026a843ca321f4e9fecdffefbce094f58af41b0d4a56c5c8f7104ba7a2cf0bdde16f632abfd720ba299083a42914393ab7ac63119e95d954cc371ef2a9840a524470d39b238dbae02762f2f948d722461bf2fbdc324e0ee3f7b1866157253b3272b6cde6425eba389aefa3587c44373e3dbfdee6bf15876df8197bd9df500b8a2a72d0087f2bdcaf4350e98ba305792149ef9fc9caeecce54b8326c00a320d9341b6f966000392c4b4b4a3c04c657cd02759d48eab2ed90b87af14ca1f99b6df44909713752c40c29aead2d9445b7e8e50f47884a052c69012d41da101cc9bf74b8328367ebbb5b6ef3fedbbeb7b5578e36c5c814a527cf80a135c67959b00b77c2e2867071d63276715ffc79277d8a1532fbb7f79cc56b9f7b6b30e8dca22ca67bb1bbccdf69008ef9fe5990cb3fc58330c1dd17670115bc07536188bef1c8bd13dec2107b074a9e38f6040734c3c806e3144475fa0d2faeb182aeabccba038622816558db3395409f2542283cb696e51ec23fba9ac9e16de629198a081b955e81d9e7e20b3714b9026ed54888499935342394668ad58f79dcb63979ec647fa941a7c1d6cdb590c2f38ff819b4f46784a0a87054b71712f025cbbc0a4cc052c5a48852419bbf7925cd29b6335d09b8f05dfa8e56040af4551b53d2c26b165439436bfc4aaebb3e157149cf0da742df5f65e78cad18d153a2980185d7d88e9abf2293070ef61c23d91b2e8ba77c2a3222b4a95280805c9e95f0bbd9cc31f6938a599297e3c70aef11ad78674a25e4a6c6714df5e8de04a4493f4c98a0944c7ef17346a3c52ab9896737986ab940a231425e793140c7b0c67782f791850053f0800c6389c9f6238c6fc9709f75aed0b7bdb1d269358d1bb8ce6e0045931999af647c7c03b125fdc7f1d30aa5b872f3127000c3f38c5f0164ecd7ba96b3c301b4796f1ec14535b8e6e834411c177a13dc68fc0a2a0322514c97d98e5cd7f204c38f1f6d80e6c4dba313ab501d35094290cac0a3a0069b68a5633f09634a6dfe6bb81f2d045a97451fa1383cbec3f4fe6b216245d377f29dedc896c7f825632d4876f42b1f3fd52fc27bf1e3be9e70c21d51e0a0fc023013ab6512998856b7593636d017258e5957c07dc6bc90d2af68e6917e6a842aa33e382a1aa2993d7bf7915483534c8c973bcbac632557c711506d45ecdbc6651946e6f57aab8bd7d859ea02294b036e7eb4fbd7efaa5c166aac16119f5edf5db3c57e45b15d5ca34a0e6a5bf8645f1102cd3ef37b6729d9b9ed8550eea5513a8a16a488a13ab2edace58b14ea441f4741a118c8a407959220c296fa6682fa20ae76b8528a3a4703b75a1de89b4006f537334bc575472fe896ddfa0504df9d0e6e8a9d986998cdd17dcd2fd6245cefb3f98f03e427dc36fdfb25446ad5bc9003aba54fea4799b241a5259c4a99e40a4755c56086c5e2dccae172326bd402b0c7d6fefb8f971306b3628d05bd9650ef43d9a9a0118501cff21d6929800cc892725c394c0923357ef449ed3ce94e3fd5b1cd33f9ec16401a59ed362ba095772e0136f42dd4fee72df047a75df722aa7cdd7ef5fd1c4171f0ee4abc6a1abd4778420892856988a0e6989477ca5728cafd176755e6ae75c620c433938c3f7cd3302437140244d25d79b095173598f96ce209b28346604ba4f64b4db5769a322692000c317484a4591e7b7f2611d5fd8150e83b373231f49470fe66d0f69ca08d650a1b848f21f6328a9bc1dc92f3da8c99c98e308eebf85b97eb85c23ae466c76c2136023eb004ccac4a1cc107ecfb6c7a8fcac9a03a96885dec1b5dc75d96de6c6bcb916e46f15349c0969c6c0081a3e7a33db02a52308b2bd6078b49b87a6544025028f4daed1206e7a293a69c4e0542dfbe53de6fd20d52425082636ef04fbf520e65fd061e4bcfd2ee33b87e77005307f06d0906c3accafb362c48fa25f7ab3bed0e7251c7ffa70a5d29dc310b4aab7138434c9cdada8271a73a9dc1f185521179ef4c5fdc26a89c764c82c9586d04dd53da86b401cdb66fe9876344d95c08376fc47436f3c7bd866ba3d7a01862a4d144ee048c5606e08efc6e816b01d0b3dfc4a23042ce0f61a6a94353292710d3f80a382b7c02e4d911f8218fe6e9c928e1cae4d9b2c1c6318a001a787eb2493fd0466cacee96d1ff4ed71c5c0cbc7425253f419dd4f67d5615d4f662472f891e7967ce2b67673d8fa36d78a584cf09070c2415da7a5fb524182d292e4bcf61c91633c10710478f4d833bc12c660bc4f57bb33c3a523cfd8c68ecc310d8a805b43addb4b7b722c8220657f77e1f60e3d69f2a09fa097300dca00dc9206ff41b51eff5d5b700f1fa10929abb64285fa1340f5d4cb1de4b9c456fdf2530a7070a7415af31ec001a7c91f270adaabb6f5a488131cd5357c568f2329a916661b22a9e5267e1a801503f867b78717e911d121930ac78b01d2222fce78497ba312b4a9be1fdcce0951e16103a18da1209418c61cd425fb1970d35717bf9c14e0b9d21f2d34a12a7c9f6c0986c728fbc24ebd8571222184bd8c2e3d0ead0ee1bb2e4a9fd0015f22045814bfa694b802111042dd0d72eb319c4296507aedc6ef9d3634fba56bd90c294c593c5749455e0ee6f2974db4d90fc9856b9872f15fbe08f6d622f9ba83d83c62785c5bb95b7d05dba8930f768c9571c1738d86980bf030d26e40d4b5270686c2c36e6087138f66315bca25553e7520e9d7c33c2385f5e721538e07f05d4d223ba7db2f980cad93f8c712119798107d7e694087a19f61538ab42e4acf40286e5394ced9b355253447ef523f52921b7580b4f9321e9dbb14bf51a569133815a363bf70567819dcbb27248371333d3199545cc4cf8d06dd3ff862acefa53a3e921b1f14e4c84817a28ad68f3621061dd741b2e16f6d9ad84c99567d5ae7012c3d02446b1d3b7347f454038af34908b8a5e997edcfedf45a491f213161a0e0e600485cbb67eafcf03cde7b6775c43407043970f9c5ba90c2499e43ebaeec5bfa8e8d3b85225ee682451cd08cd96661f85de4d3f9c360fd071bb51c9837be70a0322b8e5b73c3d99a991d69218632c6c1c306c51c8f978d6f30023cb85846fb41be5571899669c435266465fced0e7306c9c5b78f4f76564db992d00becb687fba58e31a25fb0d3d539218e1ca08856f7d3c884f354b8f617cdb73b1ac3a4d0aa8f96892f49802368ac7cefb2fc0b2d15fea1244cb2bcc09a64613496dcc0f62a447d64e24c4c096539b127f94e8c8aeec50c2d455bc0e1702e3720ca1e5b722751aa30a0f5b6c5b698e36e8940e0b0d711370a8ea4968c9763e8a2b7acf06d9e32cbf19f3cd6ef7914ee2cdf6e07ede73ad3689a5979204e7d03fafde6337fd7062d225ec9c42a1bbece342989cc877efb2582dfe7e1288b27c314dab64786c574420438577018ff07df04ac2e1f01fb26d38ad99b9ea6702e9f24dc25758ef6c317f4571dbb91bb246397fd1d764e9c133b676fcaa23a48768e7989d69b1680c99d5a9341dfee046a9130f44b95e1af41ec6a6b7f1099db012628dbcbaf5ac8d1dfe08eaaa9154d54b3bdea05c94adfb0c8d11feb1d5f558ac11a95b06ac0d7fc667d82a1dd8a41fef8cde7da99038c87c61724cd14a8a00092a2229d019505a4bb4e385f7ecf9486f11b2814cceb817038eb6573aa6b7c5ee411cec7b9992c1a433227579389923dc790b45800c1092517d31c4011fb28c5e82675463d110726283efd25425c34d801ee014ede5c78efa486da0d47abb4d9a026d49206ae23189248f2320d12cc7875f17abc472903d75ba4f04d8cbe1e9b7467473b22657e113f54eb8cfc1ecacef0d48dac2291c8c1078da4864a0c0cce99ab34098eb344d339b76e89805810cf4f94ac70fc988f9189f1ef54875a21dff75dcc0ae3d3dfd541a53426b4e5c4e51b3697e552b444b9006f2dab7ae525c48f96984372a2cec41a20d3adb8ac7122a1bdc35089a7b38efa14eaa1214cff4a1283d3430509995e51289161c0bea3b1e6a3fd085f855644f90ef5c3d5904615734a1869ee7228e7e16efbc6299e53fd23e2afbe97fd7fab85c09dea89e1ee45e28df98e8733a1312782f4faadb98ed72ffd4cded346beb578742062f4e3f44551ab6e24e8948bd6cd05e019ffe4cb49961d431aa82046cb9aacc1075f1511ab2340bc4189fc9b326dbad38dbd38bba9aa5021c7ac405bd623019402e9d92edf9cb92deadd5c223a3bdc5e722858ead6da4f85a35dc6e6c31b60f5dc5d60b836c8bbe918ecb534accb6fbbf7c6259ac79b8124138866493f095400e6cbc00df2fdb5cbcdbcdf843169f3da19aa5a6f51e3ce13c0cc28d3a30baa0845a74a7a117f691a3e6f783fba9cff7d34db382e85130c3f097080e8dd7d97a552b019453e8ff957bec446b737d4411e7d47be90f695b20344ec5ddba258b1406cc3d0c7d8351bb293932382cf462b5a140411add4e6e94f6553333fb88b6f4948c3b6ec86fb2dd62f15dda9c9561a5e6e2de788339d43325e529528812c4dac4b9559ec5f78f123fabaf4c5b0533c9b8401e3181dcadf6bba5e5b9bd3e978af133316cb3cc880945699c5330fcee7f1159f4ac12432fcd043594f2cc408d07473036481a7353788aff0a14f41871086a15b9019f39a71be4ff633dfa18e764fbf1c1793bc48aa3ce5b580fd8016419fe767b7e10401c33693bbc820108e962e7a23dad805a7983a115e456f5522363e6e00b9cf9885f760c2cf304aa94a436821cad5881cd9e863afc03f6eebbc79ecf8bc4650c6c3474220b8949df1e1b09bb71998abd42e0e1eef7ee0c0bae71c31977988d039dd005cca03d90cf956301ecc7efb12f8c8e8d7a371cec9acd0bf3346e5ad7ac987a6b0e9f096a9cecb92059fb0639e43228ee2010d7d0245cf3aa6814e8f354d3c5b292d39438a7933eae775160c4d2394cacdde10997c1f78f8de414fc940d7b9d83dcb4d284ba6a1402aeea7e276764890a40040aacf5a7b40faaa0d2553ba83c3717c3d757f754e4a6e0fe7f9ddfef0612b84324038c015e2b587e4fc201646b3342e707c9bf3c7fc00d41b5cd26651afd71a6e333cb584df73f2cef4b5ca8ec17dee216dfc756ffe2ed0b8da5e9c8e5bdd507ea0009da9f383b7740025ec96f295305a62e8dc5028bb17433b43abea4884a08111de3682e261485fb5293a45c4d74d76e438dfcc3126602258e74ad0d648790e16929031dbd531f1835fc43c7f4015c3f03246c4d7cc0864afa2bd302c202e85d7368322917ab846fe75d8a74313402e06274f08de7bd370b6e64027abc3e9e2c17dcd05b87a333342238ef32ceb2ae53802874270756a120ef23da088bfcce5fafde039b5d76e15f630f90cfb55287007a16ee48ecddcc343653646908f0a66388e62261138b43bc816c58852bc4fbafd6a9116d35d7ed6120d5c39224ded0595911cfddae6f4eaef555f43aa220e9f119547f06a8ed3c43fd45a4a5aa7deefdd5a478d2520e5cdca176e0dccde70af8f3ac8b3cedd7ac1be778c1d62b083717ecbb2859317ad5e323281b09777ad1fff58488fe8f684761ce3888094507d60564fb5822cba82e73d1df361dfdd9202af41fadef5dc39d51a48692b7795a25c931d0fad2385b1209aba7e8f9eedafc8be88f16dba0adef0b9fd974a921e141a14315c6dd485ce861adc2fd4e75c7d54efada2257061ea9001a64ea2ef9cf986fd15dbd1598e6914b8ea06363b131488399edb55f447bc526259d8e31b0b3490f7c1648c85c59b17bd6c59e1a6531591e93e898a522d1809cfca7fbad09c03fcd0060e7ce4def4f6cd042e13c72b59022e99143c0412e566a3cac7f743153e928ba8ccfc72995fde8147068cc91cb4f5a1d958e33855af0c25b5cb7e85a16a085c9aea70731ea2fe37360c54db0ef4642ad70fe91810b53e30758057986ba34221bcac2da91abe0bc21f352f5e0aeeefbcc67a21730db9bbab078363f98ba406615450c52fb16a8bc767f28bf29531d5981a8211b631fd86cfe73d82d4d50fd9d3560bd78839d9aa687094fde4bd9feb50bd8a165adf6d7f514ce9b4a2bdd046cfdc45552faa411dcedff954c8da519b742186bed2d2ea975d7172c6dca59c6a4367a2e8a0a2b4e1af7b6567f109d5e3a08d36fa23032c37824e79e08d345adcb179f47e9c72ffd6860e21351c0ce66b0da747237760e5914c96990a04970ebaccb5238bde19554efb111c382498d98c87760893b27fe26a5f35c41f565a55f00558accfee02a778ecab5ea9f36458f43f9e536a98e41d664580e566dbcc1e065f314a05eeed679c07115783226f8d2f44931778a074e391e90080d1973197f3d30eb2cb6820a9b5c3f578f51098b840f1520f1ecc2f35f9bf00daac2e82a78c563d7fb5e3e09e3c8b3df0c4405ff90d856fd28e38754ed835ea4ea3067c29458fae6b2b0e254ba4aa8bae8f7c101f1d2b8d2818b50523d7f99e531142349f36fc61106b8ea29e4ca083de701ac37708db42af38401fcdfa1bf6a1cafb9d64274836ece4ed387761e576b77ed7556807951f7217432b58d6ef8f2e1d0a593ea87f57ea79e36ec5aece937a6125ec5378b3988a7a4b323c7721782f797c667e17d48a298d3eb18855bc9b4e052d8c3168060e06747a88ec882fbae6746f3b0e55aa72d1650e498847e8654d9af95dcfbf3acb6318c89466c153c11b3531fccc1505f520545f3ae45c72980fcc3eb75ce7e6fc5856727618cb8ed8abd4ff9813d893cb98d49e2882723ac906d9306d03a82eb1d447cd779afcdf0fa937bb620c8e5feceabd0aefe5440f439d10f2797a29d679f3ac21df9e366c0baef2983ee6138ce7dff343229203ae30899410a77c8a0f0bdc07d9df5e2a6565f18e99c879f00657a843c1665280ca2f8974c891be4c09bdb9bcbd87fa3c5513f7c8ca762b57b2b23a6ec459f6e46aae864a88960ccc05f187b3a3007a8e765cadc0b9f005dd820858df94d277da149cd6b6f6cc6a637ba7647c8d8725751ff3bbd5c59ba3039d049b0a182469bee3c2836b7077bd8176708f9311c2277c83641aec1a3641c25d9821956aafeaca3bfc33d616205a3a980c6440b0c83d953fe5d08db903234ff5f8ab2372b0d26ea1fbbf8e2886364a33b990a50c11584d04ca3959549286b33e50b74cf19055965f661270a4dcd184f7