CVE-2023-24251

Vulnerability

WangEditor v5 (versions <=5) contains a stored cross-site scripting (XSS) vulnerability in the /dist/index.js component. The editor fails to properly sanitize user input for video links, specifically the iframe srcdoc attribute, allowing attackers to inject arbitrary HTML and JavaScript. [1]

Exploitation

An attacker can exploit this vulnerability by inserting a malicious ` element with a srcdoc` attribute containing arbitrary JavaScript. This can be done through the rich text editor's interface when creating or editing content. No authentication or special privileges are required beyond the ability to use the editor. [1]

Impact

Successful exploitation leads to stored XSS, meaning the injected script is permanently stored and executed whenever the compromised page is viewed. This can result in data theft, session hijacking, defacement, or other malicious activities within the context of the victim's browser. [1]

Mitigation

As of the publication date, no patch or fixed version has been released. The vendor has not publicly addressed the vulnerability. Users should monitor for updates and consider using content security policies (CSP) or input sanitization as workarounds. [1]