CVE-2022-24728: Drupal Core Vulnerability in CKEditor Leading to XSS Exploits
Summary
CVE-2022-24728: The Drupal project uses the CKEditor library for WYSIWYG editing. Affects drupal/core across 2 version ranges.
>= 8.0.0, < 9.2.15
>= 9.3.0, < 9.3.8
Fixed in 9.2.15 or 9.3.8, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-24728 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It incorporates various libraries for enhanced functionality, including CKEditor, a rich text editor that allows users to format content visually. However, vulnerabilities in CKEditor can pose significant risks to Drupal sites, especially when configured to allow WYSIWYG editing.
Vulnerability Detail
The vulnerability arises from the CKEditor library used in Drupal, which has been identified to have multiple Cross-Site Scripting (XSS) vulnerabilities. These vulnerabilities can be exploited by attackers who can create or edit content, potentially allowing them to execute malicious JavaScript code in the context of users accessing the WYSIWYG editor, including site administrators. The specific vulnerabilities are detailed in CVE-2022-24728 and CVE-2022-24729, which highlight issues related to HTML processing and Denial of Service in the dialog plugin.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 9.2.159.2.15composer require drupal/core:9.2.15 -
>= 9.3.0, < 9.3.89.3.8composer require drupal/core:9.3.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the CKEditor functionality for users who do not require it, or restrict access to content editing capabilities to trusted users only.
Conclusion
In summary, the vulnerabilities identified in CKEditor used by Drupal pose significant risks, particularly through XSS attacks. It is essential to update to the latest patched versions to safeguard your site. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerabilities include Cross-Site Scripting (XSS) issues that can allow attackers to execute arbitrary JavaScript code.
You can check your application for vulnerabilities using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Failure to address this vulnerability may lead to unauthorized access, data breaches, or site defacement, particularly affecting users with administrative privileges.
Yes, you can restrict access to CKEditor or disable it for users who do not need it as a temporary measure.
Detailed information can be found in the security advisories for CKEditor, specifically CVE-2022-24728 and CVE-2022-24729.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
