Cross Site Request Forgery in kindeditor

Description

Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.1.12

References

• GHSA-3ww4-cp53-6g2x
• CVE-2021-42228
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Cross-site Request Forgery (CSRF) in joplin - CVE-2021-23431
• Axios Cross-Site Request Forgery Vulnerability - CVE-2023-45857
• NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability - CVE-2023-45884
• Cross site scripting in kindeditor - CVE-2021-42227

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

kindeditor