CVE-2024-21911: Cross-site scripting vulnerability in TinyMCE
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h9g-x5rv-25wg. This link is maintained to preserve external references.
Original Description TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
Other sources
Impact A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.
Patches This vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.
Workarounds To work around this vulnerability, either: - Upgrade to TinyMCE 5.6.0 or higher - Manually sanitize iframe, object and embed URL attributes using a TinyMCE node filter. - Disable iframe, object, and embed elements in your content using the invalidelements setting.
Example: Sanitizing using a node filter js editor.parser.addNodeFilter('iframe,object,embed', function(nodes) { nodes.forEach(function(node) { if (node.attributes) { node.attributes.forEach(function(attr) { var name = attr.name; var value = attr.value; // Sanitize the attribute value here or remove it entirely var sanitizedValue = ...; node.attr(name, santizedValue); }); } }); });
Example: Using invalidelements js invalidelements: 'iframe,object,embed'
Acknowledgements Tiny Technologies would like to thank Aaron Bishop at SecurityMetrics for discovering this vulnerability.
References https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes
For more information If you have any questions or comments about this advisory: Open an issue in the TinyMCE repo Email us at infosec@tiny.cloud
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/tinymce/tinymceto a version that resolves this vulnerability.Fixed in 5.6.0 - Upgrade
Upgrade
nuget/TinyMCEto a version that resolves this vulnerability.Fixed in 5.6.0 - Upgrade
Upgrade
npm/tinymceto a version that resolves this vulnerability.Fixed in 5.6.0 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 5.6.0 - Configuration
Disable `iframe`, `object`, and `embed` elements in editor content by setting `invalid_elements` to `iframe,object,embed`.
TinyMCE content filtering invalid_elements = iframe,object,embed - Compensating control
Manually sanitize `iframe`, `object`, and `embed` URL attributes using a TinyMCE node filter added via `editor.parser.addNodeFilter('iframe,object,embed', ...)` to sanitize/remove crafted URL attribute values.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21911?
CVE-2024-21911 is classified as a stored cross-site scripting vulnerability affecting TinyMCE versions before 5.6.0.
How do I fix CVE-2024-21911?
To mitigate CVE-2024-21911, upgrade TinyMCE to version 5.6.0 or later.
What versions of TinyMCE are affected by CVE-2024-21911?
CVE-2024-21911 affects TinyMCE versions prior to 5.6.0.
What type of vulnerability is CVE-2024-21911?
CVE-2024-21911 is a stored cross-site scripting (XSS) vulnerability.
Where can I find more information about CVE-2024-21911?
Detailed information about CVE-2024-21911 can be found in the original advisory related to it.