CVE-2023-42426

Vulnerability

Cross-site scripting (XSS) vulnerability exists in Froala WYSIWYG Editor version 4.1.1 [1]. The flaw resides in the 'Insert Image' component where the 'Insert link' parameter does not properly sanitize user input, allowing injection of arbitrary HTML and JavaScript [2]. The vulnerable code path is reachable when a user inserts an image and then adds a link to that image.

Exploitation

An attacker requires the ability to interact with the Froala Editor (e.g., as an authenticated content editor or via a crafted link) [2]. The exploitation steps are: (1) select the 'Insert Image' option and add an image; (2) click on the added image, then use the 'Insert Link' option; (3) input a malicious payload such as https://example.com" onmouseover='alert(xss)' [2]. The payload is stored and executed when another user hovers over the linked image.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser [2]. This leads to potential information disclosure, session hijacking, or defacement. The impact is limited to the scope of the affected web application using the vulnerable editor.

Mitigation

As of the available references, there is no mention of a patched version or official workaround [1][2]. Users who cannot upgrade should consider sanitizing user-supplied link values server-side before rendering, or using CSP (Content Security Policy) to mitigate XSS impact. The vendor's latest version may include a fix; consult the Froala Editor changelog for version 4.1.2 or newer [1].