GHSA-h96f-fc7c-9r55
Regex denial of service vulnerability in codesample plugin
- Severity
- Low
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-400 Uncontrolled Resource Consumption
- Fix
5.6.0- Upgrade tinymce to this version or later
Description
Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the codesample plugin using TinyMCE 5.5.1 or lower.
Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.
Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the
codesampleplugin - Disable ruby code samples using the codesample_languages setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the codesample_global_prismjs setting
Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.
References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes
For more information
If you have any questions or comments about this advisory:
- Open an issue in the TinyMCE repo
- Email us at infosec@tiny.cloud
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| tinymce | < 5.6.0 |
5.6.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
tinymce npm → 5.6.0
- npm
npm install tinymce@5.6.0- yarn
yarn add tinymce@5.6.0- pnpm
pnpm add tinymce@5.6.0
Weakness
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How to prevent it
- Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
- Implementation: Ensure that all failures in resource allocation place the system into a safe posture.
References
Other links
Timeline
- Last updated by the source
- Published
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mf2p-h6hf-fcwm TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization | High | Also affects tinymce |
| GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments | Medium | Also affects tinymce |
| GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection | Medium | Also affects tinymce |
| GHSA-mh5m-5hw4-5c69 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs | Medium | Also affects tinymce |
| GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes | Medium | Also affects tinymce |
| GHSA-9hcv-j9pv-qmph TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option | Medium | Also affects tinymce |
| GHSA-w9jx-4g6g-rp7x TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements | Medium | Also affects tinymce |
| GHSA-5359-pvf2-pw78 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements | Medium | Also affects tinymce |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor