medium CVSS 6.1

CVE-2024-43407·PHP vulnerability

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to maintain a secure environment and reduce the risk of any security incidents related to outdated or unsupported software. The fix is be available in version 4.25.0-lts.

Severity
medium
Software
PHP
Fixed in
4.25.0
Published
2024-08-21

Affected versions

From: 4.0

Until: 4.25.0

Fixed in: 4.25.0

How to fix this CVE

Update PHP and CKEditor 4 to version 4.25.0 or later to remove the vulnerable GeSHi library dependency from your installation. The GeSHi syntax highlighter, which is no longer maintained, has been completely removed from CKEditor 4 in the patched version, eliminating the reflected XSS attack vector. Review any custom code or plugins that may depend on the GeSHi library and migrate to alternative syntax highlighting solutions.

sudo dnf upgrade php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET requests to endpoints containing 'geshi.php' or 'plugin/codesnippet' with URL-encoded or raw script payloads in parameters such as 'code', 'language', or 'snippet'; regex pattern: `(geshi\.php|codesnippet).*?(<script|javascript:|onerror|onload)`

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Configure WAF rules to block requests to any path containing 'geshi.php' or legacy CKEditor Code Snippet plugin endpoints, and implement input validation to reject requests with HTML/JavaScript payloads in code highlighter parameters. Enforce Content Security Policy (CSP) headers to prevent inline script execution.

How to check if you are affected

  1. Step 1: Check your PHP version and CKEditor 4 version by running `php -v` and examining your CKEditor installation directory for the version file (typically `/path/to/ckeditor/package.json` or `CHANGES.md`)
  2. Step 2: Search your web root for GeSHi library files by running `find /var/www -name '*geshi*' -o -name '*GeSHi*' 2>/dev/null`
  3. Step 3: Review web server access logs for requests containing `geshi.php` or encoded payloads targeting syntax highlighter endpoints: `grep -i 'geshi\|highlight' /var/log/apache2/access.log /var/log/nginx/access.log`
  4. Step 4: Verify the CKEditor version post-update by checking the CHANGES.md file or package.json and confirming GeSHi-related directories are no longer present in your CKEditor installation

FAQ

What is CVE-2024-43407?

CVE-2024-43407 is a reflected XSS vulnerability in CKEditor 4's Code Snippet plugin caused by an insecure implementation of the deprecated GeSHi syntax highlighter library, allowing attackers to inject malicious scripts through crafted requests to the GeSHi component on affected servers.

Is CVE-2024-43407 being actively exploited?

No, CVE-2024-43407 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are available. However, the medium severity rating and ease of exploitation through reflected XSS warrants timely patching.

What versions of PHP are affected by CVE-2024-43407?

CKEditor 4 versions 4.0 through 4.24.x are affected. The vulnerability is fixed in CKEditor 4 version 4.25.0-lts and later. While PHP itself is not directly vulnerable, it serves as the host for the vulnerable GeSHi library when CKEditor 4 is deployed on PHP web servers.

How do I check if my server is vulnerable to CVE-2024-43407?

Run `find /var/www -type f -name 'ckeditor.js' -exec grep -l 'geshi' {} \;` to locate CKEditor installations with GeSHi references, then verify your CKEditor version is below 4.25.0 by checking the installation's version file or CHANGES.md documentation.

Does Defensia detect CVE-2024-43407?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHP is installed on a monitored server, CVE-2024-43407 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2025-47916CVSS 10Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-43407. Free for 1 server.

Get started free