Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-43368— Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste

Quick assessment

Affected
basecamp trix
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Trix是Basecamp开源的一个适用于日常写作的丰富文本编辑器。 Trix 2.1.4之前版本存在安全漏洞，该漏洞源于存在跨站脚本，攻击者可以诱骗用户复制和粘贴恶意代码，然后在用户会话的上下文中执行任意JavaScript代码，从而导致执行未经授权的操作或泄露敏感信息。

CVSS 6.5 · Medium EPSS 0.52% · P44

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-43368

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste
Source: CVE Program / CVE List V5
Vulnerability Description
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event's `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn't have a `text/html` content type. Trix then uses the attachment content to set the attachment element's `innerHTML`. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This vulnerability was fixed in version 2.1.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Trix 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Trix是Basecamp开源的一个适用于日常写作的丰富文本编辑器。 Trix 2.1.4之前版本存在安全漏洞，该漏洞源于存在跨站脚本，攻击者可以诱骗用户复制和粘贴恶意代码，然后在用户会话的上下文中执行任意JavaScript代码，从而导致执行未经授权的操作或泄露敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
basecamp trix < 2.1.4 -

II. Public POCs for CVE-2024-43368

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-43368

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-43368 (3)

Vendor Advisories for CVE-2024-43368 (2)

Other References for CVE-2024-43368 (1)

IV. Related Vulnerabilities

Same product: trix
Same vendor: basecamp
Same weakness: CWE-79