Progress Kendo UI Editor 2018.1.221 WYSIWYG Editor kendo.all.min.js toEditableHtml Reflected cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in Progress Kendo UI Editor 2018.1.221. This affects the function toEditableHtml of the file kendo.all.min.js of the component WYSIWYG Editor. Executing a manipulation can lead to cross site scripting (Reflected). This vulnerability appears as CVE-2018-14037. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Progress Kendo UI Editor 2018.1.221 and classified as problematic. This vulnerability affects the function toEditableHtml of the file kendo.all.min.js of the component WYSIWYG Editor. The manipulation with an unknown input leads to a cross site scripting vulnerability (Reflected). The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (in the worst case) to take over user sessions.

The bug was discovered 09/26/2018. The weakness was presented 09/28/2018 as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. This vulnerability was named CVE-2018-14037 since 07/13/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Progress

Name

• Kendo UI Editor

Version

• 2018.1.221

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion