Friday, November 8, 2024
Homecyber security0-day Vulnerability In 10,000 Web Apps Exploited Using XSS Payloads

0-day Vulnerability In 10,000 Web Apps Exploited Using XSS Payloads

Published on

Malware protection

A significant vulnerability, tracked as CVE-2024-37629, has been discovered in SummerNote 0.8.18. It allows Cross-Site Scripting (XSS) via the Code View Function.

Summernote is a JavaScript library that helps you create WYSIWYG editors online.

An attacker can insert harmful executable scripts into the code of a trustworthy application or website through a technique known as cross-site scripting (XSS).

- Advertisement - SIEM as a Service

An XSS attack is often initiated by an attacker tempting a user to click on a malicious link that they deliver to them.

According to security researcher Sergio Medeiros, 10,000 Web apps have a 0-day vulnerability that may be exploited with a simple XSS payload.

Finding XSS Vulnerability In The Editor

Given the prior vulnerabilities linked to other editors like CKEditor and TinyMCE, which are known to have comparable XSS concerns, the security researcher chose to investigate the WYSIWYG Editor itself.

Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot.

This led to the SummerNote website, allowing users to see their WYSIWYG editor’s features directly on the home page.

They also included a URL to the GitHub repository, which could be used to examine the codebase. 

Users can style their input with HTML components while testing the editor’s Code View function.

The researcher chose to provide the following XSS payload to observe how the WYSIWYG editor handled “malicious” input:

This image has an empty alt attribute; its file name is Capture%20(1).webp
Testing the Code View Function

“After I set my payload, I clicked on the </> button to disable the Code View functionality to see if the editor processed and executed my payload.

To my surprise, I received an alert box confirming that the XSS payload and vector were valid!” the researcher said.

This image has an empty alt attribute; its file name is Capture%20(2).webp
Alert box confirming the XSS payload

Because the Code View function isn’t sanitized, it was possible to inject malicious XSS payloads to execute malicious JavaScript code once they reached the DOM.

According to this analysis, over 10,000 web-based applications employ this WYSIWYG editor. 

Because the Summernote editor manages user input formatting, some users are constantly susceptible to systemic, persistent XSS issues within the web application.

Thus, this ought to inform aspiring hackers that sometimes it’s better to keep things simple regarding “payload creation and exploitation.”

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...