CVE-2021-37695
📋 TL;DR
CVE-2021-37695 is a cross-site scripting (XSS) vulnerability in CKEditor 4's Fake Objects plugin that allows attackers to inject malicious HTML that can execute JavaScript code in victims' browsers. It affects all users of CKEditor 4 with the Fake Objects plugin enabled in versions before 4.16.2. The vulnerability is particularly dangerous because it can be exploited through user-generated content in WYSIWYG editors.
💻 Affected Systems
- CKEditor 4
📦 What is this software?
Ckeditor by Ckeditor
Documaker by Oracle
Documaker by Oracle
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Financial Services Analytical Applications Infrastructure by Oracle
View all CVEs affecting Financial Services Analytical Applications Infrastructure →
Financial Services Analytical Applications Infrastructure by Oracle
View all CVEs affecting Financial Services Analytical Applications Infrastructure →
Financial Services Model Management And Governance by Oracle
View all CVEs affecting Financial Services Model Management And Governance →
Peoplesoft Enterprise Peopletools by Oracle
Peoplesoft Enterprise Peopletools by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary JavaScript in users' browsers, leading to session hijacking, credential theft, defacement, or redirection to malicious sites.
Likely Case
Stored XSS attacks where malicious content persists in the application, affecting multiple users who view the compromised content.
If Mitigated
With proper input validation and output encoding, the risk is reduced, but the vulnerability still exists in the underlying code.
🎯 Exploit Status
Exploitation requires the ability to inject content into the CKEditor instance, typically through authenticated user input or content management systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16.2
Vendor Advisory: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc
Restart Required: No
Instructions:
1. Update CKEditor 4 to version 4.16.2 or later. 2. Replace the existing CKEditor files with the patched version. 3. Clear any caches that might serve old versions. 4. Test the editor functionality after update.
🔧 Temporary Workarounds
Disable Fake Objects Plugin
allRemove or disable the vulnerable Fake Objects plugin if not required for functionality.
Remove 'fakeobjects' from the CKEditor configuration plugins list
Implement Content Security Policy
allAdd CSP headers to restrict script execution from untrusted sources.
Add 'Content-Security-Policy: script-src 'self'' header to web server configuration
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all CKEditor content
- Monitor for suspicious HTML patterns in user-generated content
🔍 How to Verify
Check if Vulnerable:
Check CKEditor version in source code or configuration files. If version is below 4.16.2 and Fake Objects plugin is enabled, the system is vulnerable.Check Version:
Check the ckeditor.js file header or version.txt file in CKEditor installation directoryVerify Fix Applied:
Verify CKEditor version is 4.16.2 or higher and test editor functionality with sample content containing fake objects.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML patterns in content submissions
- Multiple failed attempts to submit malformed HTML
Network Indicators:
- Unexpected script tags in POST requests to content endpoints
- Suspicious JavaScript execution patterns
SIEM Query:
source="web_server" AND ("fakeobjects" OR "cke-plugin-fakeobjects") AND status=200🔗 References
- https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc
- https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc
- https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
