0-day Vulnerability In 10,000 Web Apps Exploited Using XSS Payloads

A significant vulnerability, tracked as CVE-2024-37629, has been discovered in SummerNote 0.8.18. It allows Cross-Site Scripting (XSS) via the Code View Function.

Summernote is a JavaScript library that helps you create WYSIWYG editors online.

An attacker can insert harmful executable scripts into the code of a trustworthy application or website through a technique known as cross-site scripting (XSS).

An XSS attack is often initiated by an attacker tempting a user to click on a malicious link that they deliver to them.

According to security researcher Sergio Medeiros, 10,000 Web apps have a 0-day vulnerability that may be exploited with a simple XSS payload.

Finding XSS Vulnerability In The Editor

Given the prior vulnerabilities linked to other editors like CKEditor and TinyMCE, which are known to have comparable XSS concerns, the security researcher chose to investigate the WYSIWYG Editor itself.

Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot.

This led to the SummerNote website, allowing users to see their WYSIWYG editor’s features directly on the home page.

They also included a URL to the GitHub repository, which could be used to examine the codebase. 

Users can style their input with HTML components while testing the editor’s Code View function.

The researcher chose to provide the following XSS payload to observe how the WYSIWYG editor handled “malicious” input:

Testing the Code View Function

“After I set my payload, I clicked on the </> button to disable the Code View functionality to see if the editor processed and executed my payload.

To my surprise, I received an alert box confirming that the XSS payload and vector were valid!” the researcher said.

Alert box confirming the XSS payload

Because the Code View function isn’t sanitized, it was possible to inject malicious XSS payloads to execute malicious JavaScript code once they reached the DOM.

According to this analysis, over 10,000 web-based applications employ this WYSIWYG editor. 

Because the Summernote editor manages user input formatting, some users are constantly susceptible to systemic, persistent XSS issues within the web application.

Thus, this ought to inform aspiring hackers that sometimes it’s better to keep things simple regarding “payload creation and exploitation.”

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

VMware Workstation & Fusion Now Available for Free to All Users

VMware has announced that its popular desktop hypervisor products, VMware Workstation and VMware Fusion, are…

10 hours ago

Dell Enterprise SONiC Flaw Let Attackers Hijack the System

Dell Technologies has disclosed multiple critical security vulnerabilities in its Enterprise SONiC OS, which could…

11 hours ago

Amazon Confirms Employee Data Breach Via Third-party Vendor

Amazon has confirmed that sensitive employee data was exposed due to a breach at a…

13 hours ago

10 Best DNS Management Tools – 2025

Best DNS Management Tools play a crucial role in efficiently managing domain names and their…

16 hours ago

Sweet Security Announces Availability of its Cloud Native Detection & Response Platform on the AWS Marketplace

Customers can now easily integrate Sweet’s runtime detection and response platform into their AWS environments…

1 day ago

Researchers Detailed Credential Abuse Cycle

Cybercriminals exploit leaked credentials, obtained through various means, to compromise systems and data, enabling them…

1 day ago