Summary
Drupal core’s built-in CKEditor image caption functionality is vulnerable to XSS.
Product
Drupal before 8.8.10.
Drupal 8.9.x before 8.9.6.
Drupal 9.0.x before 9.0.6.
Impact
This can cause malicious code to run on the victim’s browser, which can lead to the hijacking of user accounts, injecting arbitrary web-content as malicious login or payment forms, defacing a page to hide its contents and redirect users to a website of an attacker’s choice.
Steps to reproduce
In any vulnerable version of Drupal Core, copy the following payload into a CKEditor instance and switch to an HTML view (in vanilla Drupal Core, by clicking the “Source” button).
<img data-caption="<script>alert('XSS by Checkmarx')</script>"
data-entity-uuid="2"
data-entity-type="1" src="x" />Expected result:
<script>alert('XSS by Checkmarx')</script> will be loaded in victim’s browser.
Remediation
If you are using Drupal before 8.8.10, update to Drupal 8.8.10 and above.
If you are using Drupal 8.9.x, update to Drupal 8.9.6 and above.
If you are using Drupal 9.0.x, update to Drupal 9.0.6 and above.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin.
