CVE-2024-24816 PoC — Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

Source

https://github.com/afine-com/CVE-2024-24816

Associated Vulnerability

Title:Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature (CVE-2024-24816)
Description:CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.

Description

CKEditor 4 < 4.24.0-lts - XSS vulnerability in samples that use the "preview" feature.

Readme

# CVE-2024-24816
CKEditor 4 < 4.24.0-lts - XSS vulnerability in samples that use the "preview" feature. 

## Timeline
- Vulnerability reported to vendor: 18.07.2024
- New fixed 5.2.8 version released: 07.02.2024
- Public disclosure: 06.01.2024

## Description

Cross-Site-Scripting (XSS) vulnerability in CkEditor 4 sample files. This vulnerability allows an attacker to execute untrusted JavaScript code in the context of the currently logged-in user.

The vulnerability exists in sample files that use the "preview" feature:
```
samples/old/**/*.html
plugins/[plugin name]/samples/**/*.html
```

The following code can be used to achieve XSS using the "preview" feature:
```
<p>&gt;</p>

<p><a href="javascript:alert(document.domain)">XSS</a></p>

<p>&nbsp;</p>
```

This issue was caused by a lack of sanitization of the data passed to "preview" feature. This problem has been fixed in CKEditor 4 at version 4.24.0-lts.

## Affected versions
< 4.24.0-lts

## Advisory
Update CKEditor 4 to version 4.24.0-lts or newer.

### References
* https://ckeditor.com/cke4/release-notes
* https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76
* https://nvd.nist.gov/vuln/detail/CVE-2024-24816

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!