Stored XSS Vulnerability in Code16 Sharp via iframe srcdoc Attribute

Code16 Sharp versions prior to v9.22.5 are vulnerable to a Stored Cross-Site Scripting (XSS) attack originating from improper sanitization of the srcdoc attribute on <iframe> elements within the rich text editor. While the application utilizes the Symfony HtmlSanitizer to encode special characters, the HTML specification forces browsers to decode these HTML entities when processing the srcdoc attribute. This behavior effectively nullifies the existing sanitization, allowing attackers to inject and execute arbitrary JavaScript. An attacker with access to the Editor field can exploit this to perform session hijacking, unauthorized account actions, or data theft against other users, including administrative accounts. The vendor has addressed this in version v9.22.5 by explicitly removing srcdoc from the list of allowed iframe attributes in the sanitization logic.

Impact

The vulnerability allows authenticated attackers to perform actions on behalf of other users, including high-privileged administrators. Successful exploitation can lead to full session takeover, persistent unauthorized data access, and potential lateral movement within the administrative dashboard.

Recommendation

• Upgrade to Code16 Sharp v9.22.5 or later to apply the patch that removes support for the srcdoc attribute in iframe elements.
• For environments unable to upgrade immediately, manually audit and sanitize all content within Editor fields to strip the srcdoc attribute from iframe tags.
• Implement strict Content Security Policy (CSP) headers that prevent the execution of inline scripts and restrict iframe sources to trusted domains.