Stored XSS in SunEditor via Decoded Named Entities

Executive Summary

SunEditor before version 3.4.0 has a stored cross-site scripting (XSS) vulnerability. The html.clean() sanitizer's _normalizeURL() function incorrectly decodes named entities like : to an empty string. Attackers can inject href values such as javascript: which bypass the _isSafeURL() check but are decoded by browsers into executable JavaScript when victims click stored links.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect SunEditor versions prior to 3.4.0 in your environment. Check for stored links with payloads like javascript: in href attributes. Review sanitized HTML output for improper handling of : entities.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into stored content. When users view or click affected links, the scripts execute, potentially leading to session hijacking, account takeover, or arbitrary client-side code execution on their systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. The stored XSS could enable attackers to exfiltrate or manipulate data, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SunEditor to version 3.4.0 or later. Remove any existing stored malicious links containing javascript: payloads. Implement additional input validation and output encoding for href attributes.

Useful 0 Not Useful 0