CVE-2023-34245 Cross site scripting (XSS) in @udecode/plate-link
Attackers can execute arbitrary JavaScript via unsanitized javascript: URLs in the Plate editor link plugin, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-34245?
CVE-2023-34245 is a high-severity cross-site scripting vulnerability in udecode plate, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM. Users are advised to upgrade. Users unable to upgrade are advised to override the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.
Weakness: CWE-79
Which versions are affected by CVE-2023-34245?
2 open source packages ship an affected version, including @udecode/plate-link. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@udecode/plate-link npm | All versions | 20.0.0 |
@udecode/plate-link npm | All versions | 20.0.0 |
Products include Udecode Plate.
How do I fix CVE-2023-34245?
Upgrade @udecode/plate-link to 20.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-34245 being exploited?
There is no known exploitation of CVE-2023-34245 in the wild and no public exploit code.
Sources
Also known as GHSA-4882-hxpr-hrvm.