CVE-2024-43368 Information

Description

The Trix editor versions prior to 2.1.4 is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149 sanitation was added for Trix attachments with a text/html content type. However Trix only checks the content type on the paste event’s dataTransfer object. As long as the dataTransfer has a content type of text/html Trix parses its contents and creates an Attachment with them even if the attachment itself doesn’t have a text/html content type. Trix then uses the attachment content to set the attachment element’s innerHTML. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user’s session potentially leading to unauthorized actions being performed or sensitive information being disclosed. This vulnerability was fixed in version 2.1.4.

Reference

https://github.com/basecamp/trix/security/advisories/GHSA-qm2q-9f3q-2vcv https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99 https://github.com/basecamp/trix/pull/1149 https://github.com/basecamp/trix/pull/1156 https://github.com/basecamp/trix/commit/7656f578af0d03141a72a9d27cb3692e6947dae6 https://github.com/basecamp/trix/releases/tag/v2.1.4