CVE-2024-43372: Persistent Cross-site Scripting in eZ Platform Rich Text Field Type
The validator for the RichText fieldtype blocklists javascript: and vbscript: in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive.
References
- developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext
- github.com/advisories/GHSA-rhm7-7469-rcpw
- github.com/ezsystems/ezplatform-richtext
- github.com/ezsystems/ezplatform-richtext/commit/2c652915625c47b493a2be06924f4c87d1df7d8e
- github.com/ezsystems/ezplatform-richtext/commit/6131975108fa9756e17043e7a06a4e72f786f842
- github.com/ezsystems/ezplatform-richtext/commit/7bbc6d024c6146d1e1ba84d27a3ebffe9459613e
- github.com/ezsystems/ezplatform-richtext/commit/8b75c603dfd1ad6f6f3db15ae2324876683cbaf9
- github.com/ezsystems/ezplatform-richtext/commit/dbe816f3ff4c903cc508dfdcdca8791c8284d292
- github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw
- github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7
- nvd.nist.gov/vuln/detail/CVE-2024-43369
- nvd.nist.gov/vuln/detail/CVE-2024-43372
Detect and mitigate CVE-2024-43372 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →