CVE-2021-28114

Vulnerability

Froala WYSIWYG Editor version 3.2.6 and earlier are affected by a cross-site scripting (XSS) vulnerability in the HTML sanitization parser. The bug stems from a namespace confusion during parsing, allowing an attacker to bypass the editor's built-in XSS filters [2]. The vulnerability affects the editor when used in any configuration, though the Full Page configuration remains unpatched as of the advisory. The editor is a rich-text HTML component embedded in thousands of third-party websites [2].

Exploitation

An attacker can exploit this vulnerability by crafting malicious HTML content that, when processed by the Froala editor parser, bypasses the sanitization. The attacker must be able to input content into the editor (e.g., via user-generated content or direct manipulation). No authentication is required if the editor is exposed to untrusted users. The exploit can be delivered as stored XSS (if the content is persisted) or reflected XSS depending on the surrounding application [2]. The advisory notes that the use of existing XSS protections in the host application may affect exploitability [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to privilege escalation, data exfiltration, or forced actions on behalf of the user (e.g., bank transfers in worst-case scenarios). The impact varies based on the application that embeds the editor [2].

Mitigation

The fix was released in version 3.2.7. Users should update to at least 3.2.7 and use the Full Feature configuration of the editor, as other configurations (such as Full Page) may remain vulnerable even in the patched version [2]. As of this writing, version 3.2.7 is available from the vendor's website [1]. No workaround is documented for unpatched installations.