DEV Community

Abhinav Singwal
Abhinav Singwal

Posted on

CVE-2021-3163: Stored XSS Concerns in Quill Rich Text Editor

#cve20213163 #storedxss #xss #cybersecurity

Text editors are commonly used in web applications for comments, blog posts, support tickets, documentation systems, and messaging platforms. Because they process user-controlled content, security issues affecting these editors can have significant consequences.

One publicly discussed issue involving Quill is CVE-2021-3163, which was assigned to a potential Stored Cross-Site Scripting (XSS) vulnerability in Quill versions prior to 1.3.7.

What Is the Issue?

The vulnerability report describes a situation where specially crafted HTML content could result in JavaScript execution when rendered by applications using Quill.

The issue specifically involved handling of user-supplied HTML content within the editor. Since the content is stored and later viewed by other users, the impact falls into the category of Stored XSS.

It is worth noting that the vulnerability has been publicly disputed, with discussions around whether the behavior originates from browser parsing behavior or from Quill itself. Regardless of the debate, applications processing untrusted HTML should treat such reports seriously.

Why Stored XSS Is Dangerous

Stored XSS is generally considered more severe than reflected XSS because the malicious content is saved by the application and automatically delivered to future visitors.

Potential impacts include:

  • Session hijacking
  • Account takeover
  • Unauthorized actions on behalf of users
  • Phishing attacks
  • Defacement of application content
  • Theft of sensitive information accessible through the browser

Typical Vulnerable Pattern

Applications often take editor output and directly insert it into the DOM:

const content = databaseContent;

document.getElementById("article").innerHTML = content;
Enter fullscreen mode Exit fullscreen mode

If the content contains unsafe HTML, the browser may interpret and execute it.

Secure Approach

Before rendering user-generated HTML, sanitize it.

Example using DOMPurify:

<script src="dompurify.min.js"></script>

<script>
const cleanHTML = DOMPurify.sanitize(databaseContent);

document.getElementById("article").innerHTML = cleanHTML;
</script>
Enter fullscreen mode Exit fullscreen mode

This removes dangerous elements and attributes before the content reaches the browser.

Example Quill Integration 

const quill = new Quill('#editor', {
    theme: 'snow'
});

const html = quill.root.innerHTML;
Enter fullscreen mode Exit fullscreen mode

If this HTML is later displayed elsewhere in the application, it should be sanitized before rendering.

Affected Versions

Reportedly affected:

Quill < 1.3.7
Enter fullscreen mode Exit fullscreen mode

Mitigation

  1. Upgrade to the latest supported version of Quill.
  2. Sanitize all user-generated HTML.
  3. Apply Content Security Policy (CSP).
  4. Validate content on both client and server sides.
  5. Regularly review third-party dependencies.
  6. Avoid trusting rich-text editor output by default.

Security Takeaway

Rich text editors provide convenience, but they also introduce risk because they handle complex HTML content generated by users. CVE-2021-3163 serves as a reminder that any feature allowing HTML input should be carefully reviewed, sanitized, and monitored.

Even when a vulnerability is disputed, security teams should evaluate the behavior, understand the potential impact on their environment, and implement appropriate defensive controls.

Author: Abhinav Singwal

https://linktr.ee/abhinavsingwal

Top comments (0)