Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML

Vulnerability

CKEditor 4 versions below 4.17.0 contain a vulnerability in the Advanced Content Filter (ACF) module that allows malformed HTML to bypass content sanitization. This issue affects all plugins used by CKEditor 4 [1][2][3]. The vulnerability was discovered and reported to the vendor, with a fix released in version 4.17.0 [1].

Exploitation

An attacker can inject malformed HTML that bypasses the ACF sanitization, potentially leading to execution of JavaScript code. No authentication or special privileges are required if the editor is used in a context where users can submit content. The malformed HTML is crafted to evade the filter's parsing logic [1][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to cross-site scripting (XSS). This can result in information disclosure, session hijacking, or other malicious actions performed on behalf of the victim [1][3].

Mitigation

The vulnerability is patched in CKEditor 4 version 4.17.0 [1]. Users should upgrade to at least this version. For later versions, the open-source edition reached end-of-life on June 30, 2023, but the CKEditor 4 LTS commercial edition continues to receive security updates until December 2028 [2]. If upgrading is not immediately possible, ensure that the environment where CKEditor 4 is used does not allow untrusted users to input content [3].