CVE-2024-43368

Executive Summary

CVE-2024-43368 is a stored cross-site scripting (XSS) vulnerability in the Trix rich text editor, affecting versions prior to 2.1.4. The vulnerability is a bypass of a previous fix (GHSA-qjqp-xr96-cj99) that only validated the text/html content type on the paste event's dataTransfer object. An attacker can craft a paste payload where the dataTransfer claims text/html, but the actual attachment content is of a different type (e.g., text/plain containing JavaScript). Trix then uses the attachment content to set innerHTML, leading to arbitrary JavaScript execution when a user pastes the malicious content. This can result in session hijacking, data theft, or unauthorized actions.

Supply Chain & Package Security

This vulnerability affects the Trix editor, which is distributed as an npm package (trix). Organizations using Trix in their web applications should immediately update to version 2.1.4 or later. The npm package is widely used in Ruby on Rails applications via the trix gem and in JavaScript projects. Supply chain risk is moderate, as the vulnerability is in a client-side library that processes user-generated content.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must paste malicious content)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction (pasting), but the bypass nature and lack of a patch in many deployments increase the risk.

Deep Dive & Mechanics

The Trix editor uses the dataTransfer object from the paste event to determine the content type. In the previous fix (GHSA-qjqp-xr96-cj99), sanitation was added for attachments with a text/html content type. However, the fix only checked the dataTransfer object's types array for text/html. An attacker can craft a paste payload where the dataTransfer includes text/html in its types, but the actual attachment data is of a different type (e.g., text/plain). Trix then creates an Attachment object using the content from the dataTransfer, regardless of the attachment's actual content type. The attachment content is then used to set the innerHTML of the attachment element, allowing arbitrary HTML/JavaScript injection.

Attack Flow:

1. Attacker crafts a malicious payload: a dataTransfer object with types: ['text/html'] and a getData('text/html') that returns a Trix attachment with malicious JavaScript.
2. Victim copies the payload (e.g., from a malicious website or email).
3. Victim pastes the payload into a Trix editor instance.
4. Trix sees text/html in the paste event's dataTransfer.types and processes the attachment.
5. Trix sets the attachment element's innerHTML to the malicious content, executing the JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.1.4):

// In Trix's paste handling code
if (dataTransfer.types.includes('text/html')) {
  const html = dataTransfer.getData('text/html')
  // Process attachment without validating attachment's own content type
  const attachment = new Trix.Attachment({ content: html })
  // ...
}

Patched Code (2.1.4):

// In Trix's paste handling code
if (dataTransfer.types.includes('text/html')) {
  const html = dataTransfer.getData('text/html')
  // Validate that the attachment itself has text/html content type
  const attachment = new Trix.Attachment({ content: html, contentType: 'text/html' })
  if (attachment.contentType !== 'text/html') {
    // Reject or sanitize
    return
  }
  // ...
}

The patch adds a check on the attachment's own contentType property, ensuring that only attachments with text/html content type are processed as HTML.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• A web application using Trix editor version < 2.1.4
• Ability to craft a paste payload (e.g., via a malicious website or email)

Exploit Payload:

<!-- Craft a dataTransfer object with text/html type but non-HTML content -->
<script>
  const pasteEvent = new ClipboardEvent('paste', {
    clipboardData: new DataTransfer()
  });
  pasteEvent.clipboardData.items.add(
    new Blob(['<trix-attachment content="<img src=x onerror=alert(1)>" content-type="text/plain"></trix-attachment>'], { type: 'text/html' }),
    'text/html'
  );
  // Dispatch the event on a Trix editor element
  document.querySelector('trix-editor').dispatchEvent(pasteEvent);
</script>

Lab Setup:

1. Set up a local web server with a page containing Trix editor version 2.1.3.
2. Create a malicious HTML page that copies the payload to the clipboard.
3. Instruct the victim to paste into the Trix editor.
4. Observe JavaScript execution (e.g., alert(1)).

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual paste events in Trix editors.
• Look for trix-attachment elements with unexpected content-type attributes.
• Use Content Security Policy (CSP) to restrict inline script execution.

Hardening:

• Update Trix to version 2.1.4 or later.
• Implement input validation on the server side for any content submitted via Trix.
• Use a Web Application Firewall (WAF) to block malicious paste payloads.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing trix-attachment with content-type other than text/html but with text/html in the paste event.
• File: JavaScript files with trix version < 2.1.4.
• Behavior: Unexpected innerHTML modifications in Trix editor elements.
• Logs: Paste events with mismatched content types.

Detection Engineering

YARA Rule

rule CVE_2024_43368_Trix_XSS {
  meta:
    description = "Detects Trix editor versions vulnerable to CVE-2024-43368"
    author = "Valters IT"
    date = "2024-10-01"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-43368"
  strings:
    $vuln_version = /trix.*[0-1]\.\d+\.\d+/ nocase
    $patch_version = "trix@2.1.4"
  condition:
    $vuln_version and not $patch_version
}

Sigma Rule

title: CVE-2024-43368 Trix Editor XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects paste events with mismatched content types in Trix editor
author: Valters IT
logsource:
  category: application
  product: web
detection:
  selection:
    event: "paste"
    dataTransfer.types: "text/html"
    attachment.contentType|re: "^(?!text/html).*$"
  condition: selection
falsepositives:
  - Legitimate use of non-HTML attachments
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43368 Trix Editor XSS Attempt"; flow:to_server,established; content:"trix-attachment"; http_client_body; pcre:"/content-type\s*=\s*["'](?!text\/html)["']/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update Trix to version 2.1.4 or later.
• If immediate update is not possible, disable the paste functionality or implement a client-side script to validate attachment content types.

Long-term:

• Implement Content Security Policy (CSP) with script-src 'self' to mitigate XSS impact.
• Conduct a security review of all rich text editor integrations.
• Monitor for similar bypass vulnerabilities in future Trix releases.

Workaround:

• Use a proxy or WAF to inspect and block paste payloads with mismatched content types.

Report generated by Valters IT DevSecOps Intelligence Unit