安全研究
CVE-2022-48110 CKEditor 5 XSS：data-url 协议的 sanitizer 缝隙
Thinking
2022-12-10
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
CKEditor 5 改用 model + view 双层架构后，XSS 风险本应被消灭——但 sanitizer 在 model→view 反序列化时仍漏掉了 data: 协议头这一类 URL 形态。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9257681c78b2b680cc05eab1aff832f1a7ac12c13dcd57046d5edaf23ab82ee4c9586f76cdf64716d12a202177058b302e2377950ba209ea63547900b67737bec6daf04192a12629192ea250e8b7e579fa2ba9ed6ead168ba7cd4f036488ff7f8907c8f2f05817bb45346386c1f35fc6afefdca17e09bebf577ccdf130d4fc3d86f453d8ee747a168474b9200e055324b120ae95e048f9e545888b922a5527e15cd3530e28611c05611e9220b6e5d5d2b033ca7b49f9eb020f29d80142e8eddfa143813dcda794afd2d8cd8703d0eebaba916ff389d263116dfb83ed00f75ffdcff22338d8228f59359b633a526c671f9e75029d03ea927f6b2efcbfaf6ffe8daaaf3a7060f1813968db65e40fcafc208c8f7313c64a2d138fd76e8c0ec245a766ef2a13318cfd0d61a93a2db466e79e5c69a954543fd9cfbe76039d5b50995670a19ec988f3b5717adf1b393611837717329cf88a7101df235d4a0eb593851783325bbc3e1a009b643ce1873dfd34a06d16520d951276481ee080ab39972faa90942e28eca95b891a01acfb4659ca2a7399f39590e1c1a93a80254614fa7a2fc2d8a934e633bcf229a26509f73c417642d549899173d3735f6b9b8cc9a4d5d6782d026cfc6b255daca43d8da74fa4c1b19c27cde64599dd88eae28aca3f36046756299aad8160d35ef5a605c30d0d900f63071206712422b2a610dffd09677dff21b7eac692aea7c8ef0b7ea0f909e73c939f810b6d0eaa422ef9fe5990caff31c661210cd71750608d02475199da15b98c62de16d1bbc68e1a08c75473b4272d1e8dfd590c12ed293847b36e5f4c4f601626b5a14dee0245647f34e31c2da66670ff171adbee48112dd759ed2b3a4b358ad79b2523dfb3b4dd73ad937fee1948143502b5738fc1fe6ce48be7faeb020ec981d760e3e8d11c4c7d26e4a0fc891bbd9f56d514f2346422651e182f39a1571030ddf3e7c98d79a59cf842a3383cfc2404b7b0be883318c815ae1a2b378c4f64a8757435b113b3ca58f0202528de77a1080f2126c0ed7d0a33ab798887975692ee09cdc639c0e26d5b0f3b523f29f1ae8b962764a08d4eb0465bdde9a1f287cf4df23382f2afbe11cd38662bd5a4b6c7a40c45adef14353d0ee8d870e1dd6a70d2c253a5de0d2f321779aa4d043750a13af80144f374d282476321c0b4a3e00048533dd907e3f9ef3890de65ae05b26568df919bf397f7328b3485a20999af647c7c03b125fdc7f116afc18882223274e136f2fd3e6125ddc70ec283d2b0a0fd7f3e11f4b1cde53cc0a9527ab7a822d5843176786ad14aa16fda1986f264838a7ba5ee79b50cf263de68108b610d5892dd9d53630ba975d23b5a013d7c1444b46751ea5239bf67de1560c19e7d9026c91fda3baa8cc183f7de398429ed0132db7b0202437955cb47bf7c1613feaa07ad0793f8f291236b0c7dd7cb5184ebb63f0fb8491354df2ee33aa1287ac0971fbca0935f905a30672ebe03edac0f2535448737b879d27fcb2cb641834700c509d53818f5667892f7553b0b3af2fce95e22390ad36eafd4bb77be5a71dea18c1026a878bf51986adf71d1fd5ce67a6abeba28252bd5f629fe373ae23e3de9394144caf051ef22db8f251ca6cbd4117dc7e93eb53be354168c9cb123a112f426627a72c3bee06e861d46594a6227e26e49fdbf7542a0e3c23b51b446eaddf7ad4a717126e3e09227d111774119135f5f2f5290fe0ea6bc4bf264d678568cf889bda169e798ffd0ec0ba8e44fe231f4745c5b48912269cbd17325b7b4c8224e4c6ee52b9acfd95e626342898c8643024d86d8c6111bb0ca530d9f8c0cb28e742004f9b4d03e98a40492fb41229efea5e725c5124fd4702d82491c02152af9f9a7ca15d5c3461cab9cd1f9f6cc74285838b5b9dd32d512869aa2747ebd79f2816576d54119075b155f8d3777a4b52fd2256eae67c2617a583cf8b08056148452d6cacb4993f02063c1e6e4d659a8540467f0fdc81d0288b2f2907258f1c76bcdd5c21e023683700d555424a5499a0a98b245e1096514fd1ea6f384d074d17ee641d208115dd03b2b05bb13f1a0b8a980d962a3aa3c98294e1cf2c571405cda4536bbd58466acd572975f51c089fd6e8d95c7cd0a489f9b3eb9b03bb7f87c48fb39e6fd334e187b0b513b23471609e170aada54c53767d72db54e9a5e145a02f65b58d8eea504a2858c1c44402eb9c9fafe48b014e86a43e3ab82916bc4daca8829dd948ab3e659122c5767dd886d82e68e04971bdbcf08df7417599ac1241be61c49fa21efb5a42d2eb2e1f7d21be08454e2f9d114937e766f23406275cc68ec16a1ae1d71baae565aee4c0afe07a68e621db156d17cd20ff20aae09b56b763459eb48471403d887cbcb9efe39a1d9945b182f20fda9685c12f1bb0514d46e8c0f807f00b4eb415a7b0f4e76046f3ea77d9ba438f9c80082d1e4852ca9415f1268902bc0d70599c409b5ef1ccecc149c45455698a467aed90fdef9a2b9d0b05b73a00561d81cfc80e906190f224aacbecdea9bb1652063afe1268e9921f6ccf440f8f9876498201adb1274c5fd89a535c690c7a32cc1cfcc18d99e5f3393ca523c400ab6ec58e5fb21a4da56f359c81e00c36f8a45b20c6be0f323a6c9469276638eef40e33778cc2d5f097a2d82883487b850d8f70f226203f133032a0402aacad16d5b69f8f14116598b7a0d95bfbea5e1f767ba404c708bf53d14946e5f0982d4037694ee36d59d93f2173892424e55ff08ad4ebaae9afef14d0b270b57104f037d735e110c42719ed2fede330ffa58022ce616114b75e3bd3440ef0bd672d260a8517885ff472a241345f90ab9fbcd87f03c23805340aef8e18b1eb090cf717579ed6ad7a2f3087c5a642492ead851448a7860a5cf3d771085919aea30c5be2471146d90df644de008878c6815a540b6ebe8325218a2c87d4bddc9cb7caa2ea0dedfe8145e0ed29ec8a250edf12de7bc33312aa794d5e5dbd9bbde48d6386bc9b2d494bfbe14972f64d8e7b4f70ea76c2220b388ab567199acac1442c945c8471274e9e69567f6122bccdd22139dec2fb3852d905bf0e7c7c6aabea13a207ad95f1c25636cd9e014e5a6547b0b5dd200d9da22d10f554253c2dc2f1cce3486e6e9d4f93f8f55d463888e4973706c0932fff10a5785c605076e668f886c3cc7759a4da586b633a3295555cc0d2dc098b3be865ebb2f97274da0f0419e0d44c4e74136100c7e087fd149c0961afd1030ef92092f99960e2e7afac95f7e0eda8ec27d9da7232e9e4d3c2adf18cfc8ab01c037a6f3e32ef7437b1a4d443e03f3735d22c52262a9b2446053d62f1c2b6909e179a17edeb8323ad859cfa00ba87007dddde0b49139b1b9751e8806a35b671f4827db323ee219029c1f056d59c83f1c4de0521a314ca481a058e6dcdcca0af453a566abd4b10af38ef0938baa9168e727c2977fc66c6bd823e3bf2a33b4c7319333436436129736b544e63ef56bbc4d439ab49fbd8d719ae155a1c61b94277e71ee52555d3a9d968636589275f9471e453853028039ccaf6744eddc82c4a5d78bd3420c3d28ebe374f3b2ab54a40147029b527dd668ccab099472de39f1260b7e9b0d26f8fbcb9b1bf7eb7132931257ddd73c8730574607894f1f61f584c1a3da1657c6bf9e769ca3687b4b817babdfefe196d44ac816a1aca9d69930a7e7316329c7d6a2fa2cd12f5c2b7b62481116f87ea71eb7c3fcaf35fdb01252a72cd58ef02fcb9cf07b1f1486641baa88b912fd8ec58fc3c5116e633949d9788dfcd0e2dd0614ce9fb1f3a2b3d98154f333c48a2be106cfdb401aa3f1623e43e5968072dcd6a9a829544c18b078b3b1c9dfc750af322b00985aa24a10ae1f3889005207e65280a75318f7c168da083bfb6157744b1e1a503d54fdf3609049838d299945804d47f2fa435542f84f24d6f5e369c71022d6e326ec46666518bce4ae668e55b9222f7609c51d5c9b864dbf9d00a5066b478393d533668636bd8766eb2155b1cb852c4ca9d942908017e694a88c79c378edbba145ed187eae81e90fbd715c1a0e5216d4021541372386cf4315f255f974ea193ad23fa8b29367f349cb705dfbf8f02e6854fae240f921bbda7fab698747db57da94a3b0fd44df17aa71a70e670e2fca6bad48af5daa5c3306377db1f4226224105a7465670c91d68c7643e0c8d0375eb981062f41a8d268d750188f3cf4c94bc35f61365779aeaef478d9594727286209b022b5464f527eac9312e2771dfe30764f17dee2d86d7f229891aa6221f047d9fff513be87509595f50289fca3d167a8a3329761835a21f03a8a406ddf16f4fd3a0d631a9c4cb74ed2d7f297065e2ca297cc95053f450b8d19c13a8f9aeea9ca945dfa50f1ded2b3ff622c237ff4e244b477d8b3019287d2f543164a53f011e4b13af5ab7cf7637194097b8f62f6ebe3f15bf7c29a5aea1f90a640f8a9935e3ef47264e3f248312b57a1d12cc7093d2e572a39a0d0f266adeffec9e5487c56d950b0763f4a96a5e1257b8445d2b9b8040788cde1decc45be47413c9596e5e078f8d5cb3f6d91a9dbba0815cb5e56284b309c8e6860e217c3eb6e667e20f5b0f8d197db7003ee0657a4ff86e4b747eafdc7d66423f1f5c4ca8d2c71ce0a524686038107fbb8c054bfc5fdc99b97f40ee5720e75246de2cdaae63839491cf9689cbb4f4f02e7e5bedf037caae2fd487f4dc7ad9791f86033eadf541c79b636fe757c4668c069dcaa0d10999b09bb0fcc6aa1fd73b55c959b5e543455507e1d25d491fe94640afda243e0f543e634c4327a1bb48fe0c545bce4e