CVE-2024-13245
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into web pages through the CKEditor 4 LTS WYSIWYG editor in Drupal. When users view pages containing the malicious content, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. Drupal sites using CKEditor 4 LTS versions 1.0.0 are affected.
💻 Affected Systems
- Drupal CKEditor 4 LTS - WYSIWYG HTML editor
📦 What is this software?
Ckeditor 4 by Cksource
Ckeditor 4 by Cksource
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over administrative accounts, deface websites, or redirect users to malicious sites.
Likely Case
Attackers inject malicious JavaScript that steals user session cookies or credentials when users view compromised content.
If Mitigated
With proper input validation and output encoding, the risk is limited to specific content types where CKEditor is used with insufficient sanitization.
🎯 Exploit Status
Exploitation requires the ability to create or edit content using CKEditor 4 LTS. Typically requires authenticated access with appropriate permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-009
Restart Required: No
Instructions:
1. Update the CKEditor 4 LTS module to version 1.0.1 or later via Drupal's update manager. 2. Clear Drupal caches after update. 3. Verify the module version in Extend > CKEditor 4 LTS.
🔧 Temporary Workarounds
Disable CKEditor 4 LTS module
allTemporarily disable the vulnerable module until patching is possible
drush pm:disable ckeditor4_lts
Restrict content editing permissions
allLimit who can create/edit content using CKEditor to trusted users only
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline script execution
- Enable Drupal's built-in XSS filtering and ensure all user input is properly sanitized
🔍 How to Verify
Check if Vulnerable:
Check the module version at /admin/modules or using 'drush pm:list | grep ckeditor4_lts'Check Version:
drush pm:list --fields=name,version --filter="name=ckeditor4_lts"Verify Fix Applied:
Confirm module version is 1.0.1 or higher and test CKEditor functionality📡 Detection & Monitoring
Log Indicators:
- Unusual content edits via CKEditor
- Multiple failed login attempts followed by content creation
Network Indicators:
- Unexpected JavaScript loading from content pages
- Suspicious outbound connections from user browsers
SIEM Query:
source="drupal" AND (event="content_update" OR event="node_insert") AND user_agent CONTAINS "CKEditor"