CVE-2024-43407: CKEditor 4 Code Snippet XSS Vulnerability

CVE-2024-43407 Overview

CVE-2024-43407 is a reflected cross-site scripting (XSS) vulnerability in the CKEditor 4 Code Snippet GeSHi plugin. The flaw exists in the GeSHi syntax highlighter library that CKEditor 4 bundled as a vendor dependency. An attacker can craft a malicious payload that executes in the victim's browser when sent to the GeSHi library hosted on a PHP web server. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the affected site, enabling session theft, credential capture, and further client-side attacks against CKEditor 4 users.

Affected Products

CKEditor 4 (all versions prior to 4.25.0-lts) with the Code Snippet GeSHi plugin
Deployments hosting the bundled GeSHi library on a PHP web server
Applications relying on plugins/codesnippetgeshi/dev/colorize.php as an endpoint

Discovery Timeline

2024-08-21 - CVE-2024-43407 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43407

Vulnerability Analysis

The CKEditor 4 Code Snippet plugin shipped with an optional server-side helper that used the GeSHi PHP library for syntax highlighting. The helper endpoint plugins/codesnippetgeshi/dev/colorize.php accepted JSON input containing HTML content and a language identifier, passed both directly into GeSHi::parse_code(), and echoed the result back to the client. Because the GeSHi library performed insufficient neutralization of the supplied HTML, an attacker could return active script content reflected in the HTTP response.

GeSHi is no longer actively maintained. The maintainers of CKEditor 4 addressed the risk by removing the GeSHi dependency entirely rather than patching the third-party code. The fix ships in CKEditor 4 version 4.25.0-lts.

Root Cause

The root cause is improper output encoding within the bundled GeSHi library combined with a PHP handler that trusted user-supplied html and lang fields. The handler forwarded attacker-controlled content into the highlighter and returned the resulting markup without sanitization, producing a reflected XSS sink [CWE-79].

Attack Vector

An attacker crafts a URL or form that causes a victim's browser to submit a JSON payload to the colorize.php endpoint. User interaction is required to trigger the request. Because the response is executed in the origin of the vulnerable site, script execution occurs in that security context and can access cookies, tokens, and DOM state.

php

// Removed server-side handler (plugins/codesnippetgeshi/dev/colorize.php)
<?php

 if ( function_exists( 'stream_resolve_include_path' ) && stream_resolve_include_path( 'geshi/geshi.php' ) === FALSE ) {
     die( '<pre class="html">Please install the geshi library. Refer to plugins/codesnippetgeshi/README.md for more information.</pre>' );
 }

 include_once 'geshi/geshi.php';

 $json_string = file_get_contents( 'php://input' );
 $json_object = json_decode( $json_string );

 $geshi = new GeSHi( $json_object->html, $json_object->lang );

 echo $geshi->parse_code();

Source: GitHub CKEditor Commit 71072c9. The patch removes the entire plugins/codesnippetgeshi/dev directory, eliminating the vulnerable PHP handler and its GeSHi dependency.

Detection Methods for CVE-2024-43407

Indicators of Compromise

HTTP POST requests to any path ending in plugins/codesnippetgeshi/dev/colorize.php
JSON request bodies containing <script>, onerror=, or event-handler attributes in the html field
Web server logs showing 200 responses from colorize.php with unexpected referrers
Presence of the plugins/codesnippetgeshi/dev directory on production CKEditor 4 deployments

Detection Strategies

Inventory web applications for CKEditor 4 versions below 4.25.0-lts and flag installations that expose the GeSHi PHP helper.
Deploy web application firewall (WAF) rules that inspect JSON bodies sent to colorize.php and block script or event-handler payloads.
Correlate outbound requests initiated by browsers that recently loaded CKEditor pages against known-good hosts to spot reflected script activity.

Monitoring Recommendations

Alert on any HTTP request path containing codesnippetgeshi/dev after the patch is applied.
Monitor Content Security Policy (CSP) violation reports for inline script execution originating from editor pages.
Log and review PHP error output referencing geshi.php or GeSHi::parse_code.

How to Mitigate CVE-2024-43407

Immediate Actions Required

Upgrade CKEditor 4 to version 4.25.0-lts or later, which removes the GeSHi dependency entirely.
Delete the plugins/codesnippetgeshi/dev directory from any existing deployment that cannot upgrade immediately.
Disable or block network access to colorize.php endpoints at the reverse proxy or WAF layer.

Patch Information

The CKEditor team resolved the issue by removing GeSHi as a vendor dependency. Review the fix commits: GitHub CKEditor Commit 71072c9 and GitHub CKEditor Commit 951e7d7. Full details are published in the GitHub Security Advisory GHSA-7r32-vfj5-c2jv.

Workarounds

Remove the plugins/codesnippetgeshi directory from the CKEditor 4 installation and switch to the standard codesnippet plugin, which uses client-side highlight.js.
Enforce a strict Content Security Policy that disallows inline scripts on pages that embed the editor.
Restrict PHP execution in the plugins/codesnippetgeshi/dev path using web server rules until the upgrade is deployed.

bash

# Nginx configuration to block the vulnerable endpoint
location ~* /plugins/codesnippetgeshi/dev/ {
    deny all;
    return 404;
}