A significant vulnerability, tracked as CVE-2024-37629, has been discovered in SummerNote 0.8.18. It allows Cross-Site Scripting (XSS) via the Code View Function.
Summernote is a JavaScript library that helps you create WYSIWYG editors online.
An attacker can insert harmful executable scripts into the code of a trustworthy application or website through a technique known as cross-site scripting (XSS).
An XSS attack is often initiated by an attacker tempting a user to click on a malicious link that they deliver to them.
According to security researcher Sergio Medeiros, 10,000 Web apps have a 0-day vulnerability that may be exploited with a simple XSS payload.
Given the prior vulnerabilities linked to other editors like CKEditor and TinyMCE, which are known to have comparable XSS concerns, the security researcher chose to investigate the WYSIWYG Editor itself.
Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot.
This led to the SummerNote website, allowing users to see their WYSIWYG editor’s features directly on the home page.
They also included a URL to the GitHub repository, which could be used to examine the codebase.
Users can style their input with HTML components while testing the editor’s Code View function.
The researcher chose to provide the following XSS payload to observe how the WYSIWYG editor handled “malicious” input:
“After I set my payload, I clicked on the </> button to disable the Code View functionality to see if the editor processed and executed my payload.
To my surprise, I received an alert box confirming that the XSS payload and vector were valid!” the researcher said.
Because the Code View function isn’t sanitized, it was possible to inject malicious XSS payloads to execute malicious JavaScript code once they reached the DOM.
According to this analysis, over 10,000 web-based applications employ this WYSIWYG editor.
Because the Summernote editor manages user input formatting, some users are constantly susceptible to systemic, persistent XSS issues within the web application.
Thus, this ought to inform aspiring hackers that sometimes it’s better to keep things simple regarding “payload creation and exploitation.”
Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…