CODEWITHSUNDEEP
uploadckeditorxssexploit
reza
reza

Reputation: 11

Preventing Vulnerabilities in ckeditor?

  1. I want prevent users from uploading shell (exploit) on my host. I remember fckeditor, had few bugs that allowed a hacker uploads files on server. Is there a similar issue with ckeditor?

  2. How trust to users files and make sure they aren’t fake files, for example: a hacker can edit inside a pdf files -> file have pdf extension and type but has malicious code.

  3. Is using htmlencode,htmldecode enough for XSS attack?

Upvotes: 1

Views: 1767

Answers (1)

AlfonsoML
AlfonsoML

Reputation: 12690

  1. CKEditor doesn't include any file upload, you have to add that part.

  2. Again, CKEditor doesn't have that part. They sell CKFinder to fill that role and it has some checks to verify that the uploaded file is safe, but you must be very careful about which users do you allow to upload files to your server.

  3. No. If you're using a WYSIWYG editor you are not going to htmlencode the provided data, and other basic tricks aren't also enough. You need a full check like HTMLPurifier

Upvotes: 2

Related Questions