CVE-2024-45613

Executive Summary

CVE-2024-45613 is a Cross-Site Scripting (XSS) vulnerability affecting CKEditor 5, a widely used JavaScript rich-text editor. The flaw resides in the clipboard package and can be triggered when the Block Toolbar plugin is enabled alongside either the General HTML Support (with a permissive configuration) or the HTML Embed plugin. An attacker who can inject malicious content into the editor (under specific configurations) can execute arbitrary JavaScript in the context of the victim's session. The vulnerability affects versions 40.0.0 through 43.1.0. The official fix is available in version 43.1.1. As a workaround, disabling the Block Toolbar plugin mitigates the risk. No public proof-of-concept or exploit code has been released at this time.

Supply Chain & Package Security

CKEditor 5 is distributed as an npm package (ckeditor5). Organizations using this package in their web applications should verify their dependency version and update to 43.1.1 or later. The vulnerability is introduced through the clipboard module, which is a core component of the editor. Supply chain risk is moderate, as the exploit requires specific user interaction and a particular editor configuration. However, given the widespread use of CKEditor 5 in content management systems and web applications, the potential impact is significant.

CVSS Breakdown & Threat Level

The CVSS score is not officially assigned (0.0). Based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector (AV): Network (N) – the attack is carried out over the network.
• Attack Complexity (AC): Low (L) – no special conditions beyond the required configuration.
• Privileges Required (PR): None (N) – the attacker does not need authentication.
• User Interaction (UI): Required (R) – the victim must perform a specific action (e.g., paste malicious content).
• Scope (S): Changed (C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) – arbitrary JavaScript execution can lead to data theft.
• Integrity (I): High (H) – the attacker can modify content or perform actions on behalf of the user.
• Availability (A): Low (L) – the attack may disrupt the editor functionality.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Estimated Score: 8.2 (High)

Threat Level: High. The vulnerability requires specific configuration and user interaction, but successful exploitation can lead to full account compromise, data exfiltration, and further attacks.

Deep Dive & Mechanics

The vulnerability resides in the clipboard processing logic of CKEditor 5. When the Block Toolbar plugin is enabled, the editor processes pasted content in a way that can bypass HTML sanitization if the General HTML Support (GHS) plugin is configured to allow unsafe markup or if the HTML Embed plugin is active.

Root Cause: The clipboard module does not properly validate or sanitize HTML content that includes block-level elements with event handlers or other executable attributes. When the Block Toolbar plugin is active, it modifies the DOM structure during paste operations, potentially re-introducing malicious content that was previously sanitized.

Attack Flow:

1. Attacker crafts a malicious HTML payload containing JavaScript event handlers (e.g., <div onmouseover="alert(1)">).
2. Attacker delivers the payload to the victim, who must paste it into the CKEditor 5 instance.
3. The editor's clipboard processing, combined with the Block Toolbar plugin, fails to properly sanitize the payload.
4. The malicious script executes in the context of the victim's browser session.

Prerequisites:

• CKEditor 5 version 40.0.0 to 43.1.0.
• Block Toolbar plugin enabled.
• Either General HTML Support (with a configuration that permits unsafe markup) or HTML Embed plugin enabled.

Vulnerable vs. Patched Code

The fix in version 43.1.1 addresses the clipboard sanitization logic. The vulnerable code path likely involves the ClipboardPipeline or PastePlainText classes.

Vulnerable Code (simplified):

// Vulnerable: does not re-sanitize after block toolbar processing
editor.plugins.get('ClipboardPipeline').on('inputTransformation', (evt, data) => {
    // Process data.content
    // Block toolbar modifies DOM
    // No additional sanitization
});

Patched Code (simplified):

// Patched: re-sanitizes after block toolbar processing
editor.plugins.get('ClipboardPipeline').on('inputTransformation', (evt, data) => {
    // Process data.content
    // Block toolbar modifies DOM
    // Re-sanitize the content
    data.content = sanitizeHtml(data.content);
});

The exact patch can be reviewed in the CKEditor 5 repository commit history for version 43.1.1.

Exploitation & Lab Setup

Red Team

Lab Environment:

• CKEditor 5 version 43.0.0 (vulnerable)
• Node.js 18+
• Web server (e.g., Express.js)

Setup Steps:

1. Create a new Node.js project and install CKEditor 5:

   npm init -y
   npm install ckeditor5@43.0.0
   

2. Create an HTML file with the vulnerable configuration:

   <!DOCTYPE html>
   <html>
   <head>
       <title>CKEditor 5 XSS Lab</title>
   </head>
   <body>
       <div id="editor"></div>
       <script type="importmap">
       {
           "imports": {
               "ckeditor5": "./node_modules/ckeditor5/build/ckeditor5.js",
               "ckeditor5/": "./node_modules/ckeditor5/"
           }
       }
       </script>
       <script type="module">
       import { ClassicEditor, Essentials, Paragraph, BlockToolbar, GeneralHtmlSupport } from 'ckeditor5';
       ClassicEditor
           .create(document.querySelector('#editor'), {
               plugins: [Essentials, Paragraph, BlockToolbar, GeneralHtmlSupport],
               toolbar: ['undo', 'redo'],
               blockToolbar: ['paragraph'],
               htmlSupport: {
                   allow: [
                       {
                           name: /.*/,
                           attributes: true,
                           classes: true,
                           styles: true
                       }
                   ]
               }
           })
           .then(editor => {
               window.editor = editor;
           })
           .catch(error => {
               console.error(error);
           });
       </script>
   </body>
   </html>
   

3. Serve the file using a simple HTTP server:

   npx serve .
   

4. Craft the malicious payload:

   <div onmouseover="alert(document.cookie)">Hover me</div>
   

5. Deliver the payload to the victim (e.g., via email, chat). The victim must copy and paste the payload into the editor.
6. When the victim hovers over the pasted content, the XSS triggers.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor for unusual paste events in CKEditor 5 instances.
2. Inspect server logs for suspicious content being submitted via forms containing CKEditor 5.
3. Use Content Security Policy (CSP) headers to mitigate XSS impact:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Implement input validation on the server side to sanitize HTML content.

Hunting Queries:

• Search for CKEditor 5 version strings in web application source code.
• Look for configurations that enable both Block Toolbar and General HTML Support or HTML Embed.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing HTML payloads with event handlers (e.g., onmouseover, onclick) in CKEditor 5 form fields.
• Host: Browser console logs showing JavaScript execution from pasted content.
• File: CKEditor 5 configuration files with htmlSupport.allow rules that permit unsafe attributes.
• Behavior: Unusual DOM modifications or script execution after paste operations.

Detection Engineering

YARA Rule

rule CVE_2024_45613_CKEditor5_XSS {
    meta:
        description = "Detects CKEditor 5 clipboard XSS payloads"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-45613"
    strings:
        $payload1 = /<[^>]+on\w+\s*=\s*["'][^"']*["'][^>]*>/i
        $payload2 = /<[^>]+javascript\s*:/i
        $config1 = "BlockToolbar"
        $config2 = "GeneralHtmlSupport"
        $config3 = "htmlSupport"
    condition:
        any of ($payload*) and any of ($config*)
}

Sigma Rule

title: CKEditor 5 XSS via Clipboard
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS attempts targeting CKEditor 5 clipboard vulnerability
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - "ckeditor"
            - "editor"
        cs-method: "POST"
        cs-uri-query|contains:
            - "onmouseover"
            - "onclick"
            - "onerror"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of event handlers in content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45613 CKEditor 5 XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"ckeditor"; http_uri; pcre:"/<[^>]+on\w+\s*=\s*[\x22\x27][^\x22\x27]*[\x22\x27][^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CKEditor 5 to version 43.1.1 or later.
2. If upgrade is not possible, disable the Block Toolbar plugin as a workaround.
3. Review and restrict General HTML Support configuration to only allow safe HTML elements and attributes.

Long-term Measures:

• Implement a Content Security Policy (CSP) to restrict script execution.
• Use server-side HTML sanitization libraries (e.g., DOMPurify) for all user-submitted content.
• Regularly update CKEditor 5 and other third-party libraries.
• Conduct security audits of editor configurations.

Patch Verification:

• Check the CKEditor 5 version in your application:

  console.log(CKEditor5.version);
  

• Ensure the version is >= 43.1.1.

Valters IT
DevSecOps & Cyber Threat Intelligence