CVE-2019-20903: Cross-site scripting in @atlaskit/editor-core
Summary
CVE-2019-20903: Cross-site scripting in @atlaskit/editor-core. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @atlaskit/editor-core package is an npm package that provides a rich text editor component for web applications. It is widely used to enable users to create and edit formatted text content. However, versions before 113.1.5 of this package are vulnerable to a Cross-Site Scripting (XSS) attack in the hyperlinks functionality. This vulnerability allows remote attackers to inject arbitrary HTML or JavaScript code into link targets, potentially leading to unauthorized access or data theft.
Vulnerability Detail
The vulnerability in @atlaskit/editor-core arises from inadequate input sanitization in the link targets. When a user creates or edits a hyperlink, the package fails to properly validate and sanitize the target URL. As a result, an attacker can craft a malicious URL that includes HTML or JavaScript code. When a user interacts with the hyperlink, such as by clicking on it, the injected code gets executed in the context of the vulnerable web application. This can lead to various malicious activities, including session hijacking, defacement, or stealing sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the link targets before passing them to the @atlaskit/editor-core package. This can be done by using a library or function that performs proper input validation and sanitization. For example, developers can use the DOMPurify library to sanitize the URLs and remove any potentially malicious code. Here is an example code snippet that demonstrates how to use DOMPurify to sanitize a link target:
const DOMPurify = require('dompurify');
const sanitizedUrl = DOMPurify.sanitize(linkTarget);
Conclusion
The @atlaskit/editor-core package before version 113.1.5 is vulnerable to a Cross-Site Scripting (XSS) attack in the hyperlinks functionality. This can allow remote attackers to inject arbitrary HTML or JavaScript code into link targets, potentially leading to unauthorized access or data theft. To mitigate this vulnerability, it is crucial to upgrade to version 113.1.5 or later of the package and ensure proper input validation and sanitization of link targets. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @atlaskit/editor-core →
FAQ
This vulnerability allows remote attackers to inject arbitrary HTML or JavaScript code into link targets, potentially leading to unauthorized access or data theft. It can be exploited by tricking users into clicking on malicious hyperlinks or by manipulating the URLs of existing hyperlinks.
While there is no specific known exploit for this vulnerability in the public domain, it is a well-known and widely exploited type of vulnerability. Attackers can use various techniques, such as social engineering or phishing, to trick users into interacting with malicious hyperlinks.
No, only versions before 113.1.5 of the @atlaskit/editor-core package are affected by this vulnerability. It is recommended to upgrade to the latest version to mitigate the risk.
If upgrading to the latest version of @atlaskit/editor-core is not feasible, developers can manually sanitize the link targets before passing them to the package. By using a library or function that performs proper input validation and sanitization, developers can reduce the risk of XSS attacks.
There is no specific evidence of this vulnerability being exploited in the wild. However, XSS vulnerabilities are commonly targeted by attackers, and it is important to address them promptly to prevent potential security breaches.
