5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
6.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.4%
The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application.
Vulnerable Versions:
Fixed Versions:
Vector:
document.addEventListener('copy', function(e){
e.clipboardData.setData('text/html', '<div><noscript><div></div></noscript></div>');
e.preventDefault();
});
and pasting into the Trix editor, the script within the content is executed.
document.write(`copy<div></div>me`);
An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code within the context of the user’s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.
Update Recommendation: Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
CSP Enhancement: Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts can significantly mitigate the risk of such vulnerabilities. Set CSP policies such as script-src ‘self’ to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.
Credit: These issues were reported by security researchers loknop and pinpie.
CPE | Name | Operator | Version |
---|---|---|---|
actiontext | eq | 7.0.5.1 | |
actiontext | eq | 7.0.1 | |
actiontext | eq | 7.0.7.2 | |
actiontext | eq | 7.1.0.beta1 | |
trix | lt | 2.1.1 | |
actiontext | eq | 7.0.8.1 | |
actiontext | eq | 7.0.4.1 | |
actiontext | eq | 7.0.3 | |
actiontext | eq | 7.0.7.1 | |
actiontext | eq | 7.0.0 |
discuss.rubyonrails.org/t/xss-vulnerabilities-in-trix-editor/85803
github.com/basecamp/trix
github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad
github.com/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554
github.com/basecamp/trix/pull/1147
github.com/basecamp/trix/pull/1149
github.com/basecamp/trix/releases/tag/v2.1.1
github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
github.com/rails/rails/commit/07e6c88cc4defe6f6b8d28e79eb13a518e15b14c
github.com/rails/rails/commit/260cb392fc1ee91d0b749cff08d1c8d54b230bd3
github.com/rails/rails/commit/73fac32511eefdd45d8f00fecc2b8cc5408ea6d5
github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-34341.yml
nvd.nist.gov/vuln/detail/CVE-2024-34341
rubyonrails.org/2024/5/17/Rails-Versions-7-0-8-2-and-7-1-3-3-have-been-released
rubyonrails.org/2024/5/17/Rails-Versions-7-0-8-3-has-been-released
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
6.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.4%