CVE-2024-29203: TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets.
Fix TinyMCE 6.8.1 introduced a new sandboxiframes boolean option which adds the sandbox="" attribute to every iframe element by default when enabled. This will prevent cross-origin, and in special cases same-origin, XSS by embedded resources in iframe elements. From TinyMCE 7.0.0 onwards the default value of this option is true.
In TinyMCE 7.0.0 a new sandboxiframesexclusions option was also added, allowing a list of domains to be specified that should be excluded from having the sandbox="" attribute applied when the sandboxiframes option is enabled. By default, this option is set to an array of domains that are provided in embed code by popular websites. To sandbox iframe elements from every domain, set this option to [].
Workarounds The HTTP Content-Security-Policy (CSP) frame-src or object-src can be configured to restrict or block the loading of unauthorized URLS. Refer to the TinyMCE Content Security Policy Guide.
References - TinyMCE 6.8.1 - TinyMCE 7.0.0
Other sources
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/tinymce/tinymceto a version that resolves this vulnerability.Fixed in 6.8.1 - Upgrade
Upgrade
nuget/TinyMCEto a version that resolves this vulnerability.Fixed in 6.8.1 - Upgrade
Upgrade
npm/tinymceto a version that resolves this vulnerability.Fixed in 6.8.1 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 6.8.1 - Configuration
Enable sandbox_iframes to add sandbox="" to iframe elements; in TinyMCE 7.0.0 onwards this defaults to true. Set sandbox_iframes_exclusions to [] to sandbox iframe elements from every domain.
TinyMCE sandbox_iframes = true - Configuration
Configure the CSP frame-src or object-src directive to restrict or block loading of unauthorized URLs.
HTTP Content-Security-Policy frame-src or object-src = Restrict or block unauthorized URLs
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29203?
CVE-2024-29203 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-29203?
To fix CVE-2024-29203, upgrade TinyMCE to version 6.8.1 or later.
What is the impact of CVE-2024-29203?
The impact of CVE-2024-29203 allows attackers to execute malicious code through injected iframe elements in the TinyMCE editor.
Which versions of TinyMCE are affected by CVE-2024-29203?
CVE-2024-29203 affects all versions of TinyMCE prior to 6.8.1.
What type of attack does CVE-2024-29203 facilitate?
CVE-2024-29203 facilitates cross-site scripting (XSS) attacks by allowing malicious iframe elements to be executed.