CVE-2024-24815

Affected packages

The vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that:

• Enabled full-page editing mode,
• or enabled CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements).

Impact

A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. It affects all users using the CKEditor 4 at version < 4.24.0-lts.

Patches

The problem has been recognized and patched. The fix will be available in version 4.24.0-lts.

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

Acknowledgements

The CKEditor 4 team would like to thank Michal Frýba from ALEF NULA for recognizing and reporting this vulnerability.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.

These are all security issues fixed in the python310-django-ckeditor-6.7.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-django-ckeditor fixes the following issues:

• Update to 6.7.2

  • Deprecated the package.
  • Added a new ckeditor/fixups.js script which disables the version check again (if something slips through by accident) and which disables the behavior where CKEditor 4 would automatically attach itself to unrelated HTML elements with a contenteditable attribute (see CKEDITOR.disableAutoInline in the CKEditor 4 docs).

• CVE-2024-24815: Fixed bypass of Advanced Content Filtering mechanism (boo#1219720)

• update to 6.7.1:

  • Add Python 3.12, Django 5.0
  • Silence the CKEditor version check/nag but include a system check warning

• update to 6.7.0:

  • Dark mode fixes.
  • Added support for Pillow 10.

• update to 6.6.1:

  • Required a newer version of django-js-asset which actually works with Django 4.1.
  • CKEditor 4.21.0
  • Fixed the CKEditor styles when used with the dark Django admin theme.

• update to 6.5.1:

  • Avoided calling static() if CKEDITOR_BASEPATH is defined.
  • Fixed ./manage.py generateckeditorthumbnails to work again after the image uploader backend rework.
  • CKEditor 4.19.1
  • Stopped calling static() during application startup.
  • Added Django 4.1
  • Changed the context for the widget to deviate less from Django. Removed a
  • few template variables which are not used in the bundled
  • ckeditor/widget.html template. This only affects you if you are using a
  • customized widget or widget template.
  • Dropped support for Python < 3.8, Django < 3.2.
  • Added a pre-commit configuration.
  • Added a GitHub action for running tests.
  • Made selenium tests require opt in using a SELENIUM=firefox or SELENIUM=chromium environment variable.
  • Made it possible to override the CKEditor template in the widget class.
  • Changed CKEDITOR_IMAGE_BACKEND to require dotted module paths (the old identifiers are still supported for now).

Kevin Backhouse discovered that CKEditor did not properly sanitize HTML content. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24728)

It was discovered that CKEditor did not properly handle the creation of editor instances in the Iframe Dialog and Media Embed packages. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28439)

It was discovered that CKEditor did not properly handle parsing HTML content. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. (CVE-2024-24815, CVE-2024-24816)

It was discovered that CKEditor did not properly sanitize version notifications. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)