cyber security

0-day Vulnerability In 10,000 Web Apps Exploited Using XSS Payloads

A significant vulnerability, tracked as CVE-2024-37629, has been discovered in SummerNote 0.8.18. It allows Cross-Site Scripting (XSS) via the Code View Function.

Summernote is a JavaScript library that helps you create WYSIWYG editors online.

An attacker can insert harmful executable scripts into the code of a trustworthy application or website through a technique known as cross-site scripting (XSS).

An XSS attack is often initiated by an attacker tempting a user to click on a malicious link that they deliver to them.

According to security researcher Sergio Medeiros, 10,000 Web apps have a 0-day vulnerability that may be exploited with a simple XSS payload.

Finding XSS Vulnerability In The Editor

Given the prior vulnerabilities linked to other editors like CKEditor and TinyMCE, which are known to have comparable XSS concerns, the security researcher chose to investigate the WYSIWYG Editor itself.

Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot.

This led to the SummerNote website, allowing users to see their WYSIWYG editor’s features directly on the home page.

They also included a URL to the GitHub repository, which could be used to examine the codebase. 

Users can style their input with HTML components while testing the editor’s Code View function.

The researcher chose to provide the following XSS payload to observe how the WYSIWYG editor handled “malicious” input:

Testing the Code View Function

“After I set my payload, I clicked on the </> button to disable the Code View functionality to see if the editor processed and executed my payload.

To my surprise, I received an alert box confirming that the XSS payload and vector were valid!” the researcher said.

Alert box confirming the XSS payload

Because the Code View function isn’t sanitized, it was possible to inject malicious XSS payloads to execute malicious JavaScript code once they reached the DOM.

According to this analysis, over 10,000 web-based applications employ this WYSIWYG editor. 

Because the Summernote editor manages user input formatting, some users are constantly susceptible to systemic, persistent XSS issues within the web application.

Thus, this ought to inform aspiring hackers that sometimes it’s better to keep things simple regarding “payload creation and exploitation.”

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,' who claims to have compromised the…

21 hours ago

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users, leading to widespread reports of Blue…

1 day ago

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have drained billions from victims' wallets. This…

1 day ago

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which link to a variety of systems…

2 days ago

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and often have extensive community support, making…

2 days ago

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are largely employed for communication and collaboration,…

2 days ago