CVE-2021-41164: Drupal - CKEditor4 Advanced Content Filter (ACF) Module HTML Injection Vulnerability
Summary
CVE-2021-41164: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML. Affects drupal across 3 version ranges.
>= 8.9.0, < 8.9.20
>= 9.1.0, < 9.1.14
>= 9.2.0, < 9.2.9
Fixed in 8.9.20, 9.1.14 or 9.2.9, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-41164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) that allows users to easily create and manage websites. CKEditor4 is a popular WYSIWYG HTML editor used by Drupal to provide a rich text editing experience. The Advanced Content Filter (ACF) module in CKEditor4 is responsible for sanitizing and filtering HTML content to prevent malicious code execution. However, a vulnerability has been discovered in the ACF module that allows an attacker to inject malformed HTML, bypassing content sanitization and potentially executing JavaScript code. This vulnerability affects all plugins used by CKEditor4 and impacts users of Drupal versions prior to 4.17.0.
Vulnerability Detail
The CKEditor4 ACF module vulnerability allows an attacker to inject malformed HTML code that bypasses content sanitization. By exploiting this vulnerability, an attacker can execute arbitrary JavaScript code within the context of a user's browser. This can lead to various security risks, including cross-site scripting (XSS) attacks, session hijacking, and unauthorized access to sensitive information. The vulnerability affects all users of CKEditor4 with Drupal versions prior to 4.17.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.9.0, < 8.9.208.9.20 -
>= 9.1.0, < 9.1.149.1.14 -
>= 9.2.0, < 9.2.99.2.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly recommended to apply the fix by upgrading to Drupal version 4.17.0 or later.
Conclusion
The CKEditor4 ACF module vulnerability in Drupal poses a significant security risk, allowing attackers to inject malicious code and potentially compromise user data. It is crucial for Drupal users to upgrade to version 4.17.0 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
CKEditor4 is an open-source WYSIWYG HTML editor used by Drupal to provide a rich text editing experience.
The Advanced Content Filter (ACF) module in CKEditor4 is responsible for sanitizing and filtering HTML content to prevent malicious code execution.
This vulnerability allows an attacker to inject malformed HTML code, bypassing content sanitization and potentially executing JavaScript code. This can lead to various security risks, including cross-site scripting (XSS) attacks, session hijacking, and unauthorized access to sensitive information.
All users of Drupal versions prior to 4.17.0 are affected by this vulnerability.
To fix this vulnerability, users should upgrade their Drupal installation to version 4.17.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
