======================================================================

                               CERT-Renater

                    Note d'Information No. 2024/VULN262
_____________________________________________________________________

DATE                : 24/05/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Ruby on Rails embeding the Trix
                         editor versions prior to 7.1.3.3, 7.0.8.2.

=====================================================================
https://discuss.rubyonrails.org/t/xss-vulnerabilities-in-trix-editor/85803
_____________________________________________________________________


XSS Vulnerabilities in Trix Editor
Security Announcements

rafaelfranca (Rafael França) May 17, 2024, 4:57pm 1

Original advisory

The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary
code execution when copying and pasting content from the web or other
documents with markup into the editor. The vulnerability stems from
improper sanitization of pasted content, allowing an attacker to embed
malicious scripts which are executed within the context of the
application.

This vulnerability has been assigned the CVE identifier CVE-2024-34341.

Rails >= 7.0 embeds the Trix editor in the actiontext gem to be used
with the Sprockets assets pipeline, so new releases of Rails with
fixed versions of Trix are now available.


Rails 6.1 doesn’t embed the Trix editor.

Applications using Rails >= 6.1 and not using the Sprockets assets
pipeline are recommend to upgrade the Trix package using the
JavaScript packager manager to one of the fixed versions.

Versions Affected: >= 7.0.0. Not affected: < 7.0.0
Fixed Versions: 7.1.3.3, 7.0.8.2


Releases

The fixed releases are available at the normal locations.


Impact:

An attacker could exploit these vulnerabilities to execute arbitrary
JavaScript code within the context of the user’s session, potentially
leading to unauthorized actions being performed or sensitive
information being disclosed.


Workarounds:

CSP Enhancement: Additionally, enhancing the Content Security Policy
(CSP) to disallow inline scripts can significantly mitigate the risk
of such vulnerabilities. Set CSP policies such as script-src ‘self’
to ensure that only scripts hosted on the same origin are executed,
and explicitly prohibit inline scripts using script-src-elem.


Credit

These issues were reported by security researchers loknop and pinpie.



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================