安全研究
CVE-2020-981 CKEditor 4 XSS：富文本编辑器的 sanitizer 边界
Thinking
2020-05-12
1 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
CKEditor 4 在 v4.13 之前的 sanitizer 对某些 HTML 标签属性组合存在净化缝隙——攻击者只需构造一条精心设计的 HTML，就能把 Stored XSS 注入到使用 CKEditor 4 的所有应用里。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc927768cc78b3abeb489e64771f9ac030a7cc76355dc05cc98c6aeb539b481ee4c9586f76cdf66445012b922354e1d32a53a81a629ef2cc3f41b32cd1fc33e76f178a295ec5be4891271712506bd736d95a2baa0d4f2efae659e7c13af8e4b116b5cf848c1d328cb4fdf92d5e4dc973b96156907966852137599351984a2df3723e5b469d7e91bf27d2a1d957f8e6f521022ae73bfcac6cc5156d6f8ea6aa4fefb69beed1a01981cd6ec382d306e5f4375057d8c82fa8aec67e3948319231d665e4f634c9544e0e638823d1bd09f0eebaba916ff0ed96f67169cf4638c1821ab90a6353f9ad028f1df44aa7ae279c16ef3e549688619e768a2f7e289b6b9a0ebcbb49aeb475c4b0e94dff3114daefdc20c84ea2d7523fdd82afa72f681baef8290ff1806b8c22951018e916b05fcb5fc4f01013181d86b80e8eb3a71fff645d4345904eecad62c5b00fff1b7df7c047e362c2fd383b20710ee3a848cd479715b633223fe99b5a45b8133ab0a2e858d0bc958de4ee1685014c7a94f58f4ccef69d7e2a861560898bd99ab049b3b814f36d601ebe3ad342577beeb90a8bec7c98c98d1730f98893dc73416c7a15a85029daac45f8bcd90a79087094b7d0e67c3b8ad088301b01f68c03b739345822ff8039bdb6ea33e2d65a6e7e2ba782a401b2f7074e339cd5ead8ec83187eafe2cdf9d49a03254642e445c376e3454bbda8c2890e54f2afe6f35ee6e8faefdb5048c8f779638fc52bbd4bcff05add3aada47aded367a5a03cd3239475b9f71644b9bbe5f8ac773ab3210a079e5ff837c083041248a2036071b30ecd0e42ebdb9230859e8420d08461b96f33a7c5bb70767c2992a2640e625f9ece29e16cf74c098ecafaf49a926b2557ee13157c635841bc6d0dcdd074027395a8103e5ce9532c9d4c354674df25a375bdc58552e25abd096cba09ed8f345514f2346426745a7c1a513948e1218c7683591d6d6d0365f31738bc9944086fbff7b57e3061dea26657ff87497029f281e57624c08dcdb27760f8da80830d0b80c167bfcadd5381c9ab26a787906ee8ff8608412e20c6e6040ab4262daedaf67acf9c05a21ac87236f5fa6a0b47663a2d4fcf35d01902323e47f82db9fc55e995bc4e21c2b93a680c941498fa50b293c670aa6858f2134d6e5831068085da2c0514d294f337a257f1a0b14390d198530d2c01b6bdbfec54ca41fac457080102b904dc7e5d3a8fd024176c6e2b50fca8e74461ad12f1461ef54c970a7e98ccbded05f08d500817bb73b59645e4adab0ae511f45d44e981413ce62ee61939e8ccdf37764468a3595ab9e6f2c177bfdf4cd187104ba7dba43cc55b274a59c7d82dacd6496ae7d23fc8c2ff6c195f7090a35cc7f99960fd51557161c4be5a9102109064314de4c75aaf479de963163ecbb43791eea2ca415a9f70d73ffc211fef4ba69e191fe59cbe166a40859ddaa8ad7f3c02915acf256f400c8c01407a0dc7871dc63ea221f6b4719dcd9a7301148b4f124589445f64094b428573674fb100f68b734529b80d278602ae5271973ed1065da241fa5e437eaec55de32c1026a878bf50595a1ad4b4285cb7da3b6aabc8652ab03328eee2da52de5d8d6d51b41be0c11aea47315dd55fc52da8d14f01df75cf63a1751c9885e7b427c5f6469a63628af17e7688a78c6f0353639e09cccf81e3985f7d3378b89e47811f7147d0903e380b0cfe796d2dc8191569e8bf5290daffb2790ec234370d93992dd1514ee13c44e75ee0db7ae60d533135d5e95aa59bf46e183909f878620e18a262262aa4037582c2faaa9e7c2c89aa2d200d752898e68e53954c0959cfe65825f5924b40b5cf2ea13795351c09e5ba51d7e0b151f74c8cc33aa521be490520b73ab3ac1ff72ea0071c83fa2e2388d017e635d90c7ad8fd9eb52c242e5f11efae9d7a423489f1fe877a5895219ffb24dd7bf2ca05da3b24c430ce20fb4abbca47b3cc9fada7acd9a90c7fd93e9640d5c6a4234b0b2c93b913a7d4025ca8ba9514993e828ca87a6e96ed4aea70bdde6fef73a741096514fd1ea6f7f1a4e5845b373076b8304d411a4a214f0255216808d1ad82e76afc39ad3f245e6b990ec56a67623ae466c6acd572969bd0f08c0dee0dc0f229eb79ff9eba89b05a03788d998be9e6ddd22e1c6f1e49560d0f8960515668ed31630223220db41e9625bfde42b7cf18b8ea65550700d9347a9d16c707823726b89aa6561f3ef32e5f9379d2973deb7b029b25c339c6a984ccb686b1aeb19ff010e8718616c0dca816432cab5beea37572fc6b138682e64d3c7b97cb161185e43f8153769fa1584214c4949681e27fa18d4f3dff0e81118276879bb1f62b258df7d0f3ea050e960fbfac314ae161e8becc7632b46990cd690a0bdad5df56ecee6ca43a4aac8881e8c0da48883253477de0b86d0c26abaff84c03b31eaa715f0d212b9e8e0304f474921b9ac6b8d12d77eb8741159eb38a935a5c7869b479a366835ec761c8a88219c815f37dda1b639095606afc8f30235b67f70d9674111667227640e1f50b4263f959b5536ec124fb9d32459e478a9da58793ca9990f2b7165111754df63b9dca083bb2359f911855e8034b6a731f6062bec635f170161dbc42912f7e67e31c7b38aa7489ab7c3b0261ed7a1f2252f6c5752eafa4fd24906e31309ba1ef95c0b5a5b57e4097ee3e31984ff0c0dbddb8454e1f3bc35bda5538fa3913590bc61af0c854316714c3df881bcbca0861554cd35eeb863a7fc275f665a38a8f46f69108050c6318c3472e3a751db20990bd19107f46a2bd1754a2f2fdc46612c855e30c98057cdc62e14a1609451cd07cf25a7d5943b4115c6e24eaffcb817ab946d2f239e6000cfdb2b94ba7f99b22b2b750c6225fda1f968fc1c34e2b95514d198cbe1d3fa4b2a624b959ce0c6328533a92a95538450ea4d33616ce3f1147fed3de5a6bcbaf5a388cdc2f783959544bad00fcd860fd734f244b84dbfd223bdadd3957663361555e14d714195fc8f4f29d88c21cd23c8d29815af729b6d578ca13d41d5d7c23d798115836d7849c1385d726037e382c0302985c2b56c07c75cb618702d36f38062d548f5daa3bf1252c49f0d7979680387abd50e64c8a02b5acf0f640a0e9fc496fc0d6e7055f320215d80156584e4976b00cfeb48bd10b569033b1ea363a17e50235a84a52b328371626a2484531d818fc056db37f461b6f7f03a22d9094b52e3d51043f2dbcfc77c765d5ac514f9b5745cd88626b37c2155e603346943536604312058a25b1a88b01a05aba1fcdef599e1fa571735f49b8a2a0203dbe6f638b91ab1b632cf622ef20c8fc2f5cee000083e4611d656f5a0e86eab37433ba9876f17ed815c1d844a2196f80fce232d3f49aa3296b60413cc6ae777bc2334d921679999751ec6e9ea08b4290959ca6957c600648254353f897a7bdf56b453778bc2b46393eedaa981a6512f49c3c0b78f0675504bfcc4c111faff87e0ff9b2de510d5ab9b3a6e1fc2470c88091b55016298559b7a99eb68109d2b2c37006772abb776b7a97ded691d6bc2d7892e45610a7d6522bc4c512496c7c1a4651e7df00daa0100757ae8689f28dddddfc92a626864e0eb6d3a78bb51f0d6aef0dd40df68396f8bbe92e323c1c3325210d1e891464901780de5374f33531ded3bfb580857a36f32f5e40bab1d89c8331c518f25d253310f43641589aaba6b3c83451902658044d4b42208ffef660702a45ca75c1dacbeab439dc311d0b14f85c726170b3d627e05e810d800b8345240bb62dacd1e7442218aab1ac132beea7d949519b2124595e29c65ec110f929fb70cc5d16da7a58a804768826fc0c3d21f81818955c041c1bb3342f930ea51d1fea914a23d6e305fd1cc1d2f609bdfa751cdde8d2845623df892d7451eea17ce5d92f25907f87ff5e9da6c558c486af10e066098b6eaf9968a1cbd6b31204965941b600ddfd7178e6863913d557dcd9440f12609ecd7f3ca0a6e5d7cbbef8a3e331784a352a5b22bfcd48b718a02696115f8e3c1e3e0c2701f10ee2f1023889e0ae7b3f851d0fb875ee70fac296e5b2211d7b9d1fa25cacdb9d250d52c999736f7902b35691c91802d303a5d69d09444b72209b824bc1b3861eb3942b061a9082c02ec12e1ae14d4e50bd9762651312b6d795a6f49efc098759b84bf422c2bcf374e08be19e4ed5c0d3fd98eba30779fc8367c8d7fe8665eddf56ac66263b52764047e42652ab748ca8f18039440c202541f528652ceb35517e4da21a5635e9518c47fdbf9ba79b271fb28484f79d5a0684e389264f99498ab6c3ab7e1e957876003205cfd2d66da927584f7e898470fda39a4c9f865ed1b5b2a495b2403d7d755b5d822a4302d14108de0acdeb9aa54e4a60607ec1537f609d3d270ece23a7a1de92548405a61c4d3f643f381f2dbac40945461c1f47e6c6e0c35896cb523dcc65f56f4a8f6aa04077595f049fd822d36116b11c577bf196d0c931baa81877dcbc72f5e606fb25f0716bc6e0d3bab467765baf174304a50c7317c76d49c06ca1c169db49a4e8a1421a2026e3aa12454feefb7d947c6b4e9d849678e4d81ac1cd4f7d45271ed9418e451c0007c294b6757c3ac599365322cff1e2e7d0cf0c51ce6aeb6f29ec82428a44fb9a5264d6e3825667e67fdc11ba05e2312baad34e0e36f9be69c53e8c53c9332261c5f653c6271419eb7aea6ba03b6de11553325387015202cea403f78f75b1d339ee514f29646ba78cd41557423dbc7f5dc3a80ad79873c279456cbbd5715173d5a31e8dbd07d002aa7beb29885d35d123f07113c9cfbcd3837a10670fdb6705218eb1fca83136d59a3aa99aee7a2c805b8603f5b529f28ca3e08be529d40e34cf43fc6bee0ff96b0e2d75941f81c90e22b5d92659bb27453468a32cbe1862cd8adc3940cc14aebe7530908940dcd9f66b86009f69af3a406cf8250463708d12ec9ce187c3b2b84cc16e84cf51b9019f39a71be4ff035c3bc93204dbb4a0188b056a66ce7e685aa16d1920e77c8dca2400b9dba49354ee8f4c7d7e1b2cb5632e52550bd80a387216549127a7715a5ced1c7bc71a973dfe2f21405372c9b8e854c88bcef5634fab90636eb45a0f40b159a4fa385e565400d49203c4b715fd76404dd87d34efb060dfbea00638e3e849628d40c508b42b16cbf16646a42bb5cb02d066b045146fcede5587792e3206e33cee3c0b9e7f5c2bfd5cdf144c5b0de73abe77f1e5502710743d810c0cd0adcf0a2cbcadaa5abb76fbcd7059f18302e286fd68a93875ec13047377071f9c020a0445c65f933ac9fdf06289af5663d1ae0b9a61066a086593cdfc9c03d62f3ac990b1329bce887b2d19ea3c69fc87161643162fce624edc9ed20827a4bcff2bd231e5eb32d226d290d631576c02c9a8820a5a54a47f58fb6d40183d678bbc8f4acc7d195fe0af9a52db9e232cb442a465a963daa05958d428b6459b21e2c8c96950f1c082043587eba5d8c8207fc9bd7e1022d8454206a828074005884c88a78ae80945577b95ccc09d2c8653f7b671bb48d3e3ac9e6c39c5869bc0011fa4b73d139b3f1a1f54d0ae6cc212909e39efde4bdb5e1f1a7480aa652cb14ae5fd9489151718788998291cfa7c019b551ab383cd28b0c353f2a039d40de49bcdcf5ccca5972e53bed0bd48209b6f9b4be82ed025edac2a509310f7427fe390498765ff30f45ee4e2e3151eae2112e596808c8bbd5835b7b8a80e51ebfd8fe9e16fc01e64677887ab2517dbd701ecf19349a71752e096b07ba43cbc3801215717a2248a9dcc55ff2e2188152a80be9300744c07dd193bb2c0b124f889f1ff6df6f55379f83d95a7b8923509c49771955e61ef64eb62062315afefa5555087df73db1caba595297408728fc5448dabab79030972a7008288cf0b694c7562db153747488f671bc005f5bee66b21e5f680ebf2ddbc880c608ec78dc35436988b370f2900c1ca3ef44f7