GHSA-v4jx-8pj6-w4w8: SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using SunEditor versions before 3.4.0 are exposed if they allow attacker-controlled content to be stored and later rendered to other users. Exploitation requires a victim to click a stored malicious link.
What does an attacker need to exploit it?
An attacker needs a way to submit HTML content that SunEditor sanitizes and stores, such as content containing an href value like javascript:. No authentication or special privileges are required according to the supplied vector, but victim interaction is required.
How can I tell whether my deployment is affected?
Check whether the application uses the npm suneditor package at a version earlier than 3.4.0. Also review stored editor content for href values using named entities that may decode into javascript: URLs, particularly javascript:.
What should be done if upgrading is not immediately possible?
Prevent untrusted users from submitting or storing HTML links, or apply server-side validation that rejects URL schemes which decode to javascript:. Review and remove previously stored malicious links, since the vulnerability affects content that has already been saved.