Listen to this Post
The vulnerabilities addressed in Etherpad PR 7906 encompass a set of six distinct weaknesses affecting versions prior to 3.3.0. These issues range from weak random number generation for session tokens to information disclosure via error messages. The first vulnerability involves the use of `Math.random()` for generating author, session, and read-only IDs on both client and server sides. Because `Math.random()` is not cryptographically secure, it could potentially allow an attacker to predict or guess these tokens, leading to session hijacking or unauthorized access. The fix replaces this with crypto.getRandomValues, a cryptographically secure pseudo-random number generator. The second issue concerns the OIDC login mechanism, which used a non-constant-time password comparison and lacked a failure delay. This creates a timing side-channel vulnerability (CWE-208) and opens the door for brute-force attacks (CWE-307). The remediation introduces `crypto.timingSafeEqual` for constant-time comparison and adds a uniform failure delay to mitigate these risks. Thirdly, the plugin dependency handling was vulnerable to a path traversal attack (CWE-22). Plugin dependency names from `package.json` were used to construct filesystem paths without validation, which, although gated behind admin privileges, could still lead to arbitrary file access. The patch now validates these names against the npm naming grammar. Fourth, the `/api/2` endpoint suffered from API parameter pollution (CWE-235). It merged all request headers into the API field set, potentially allowing attackers to inject or override parameters. The fix now forwards only the `authorization` header, aligning with the `openapi.ts` handler. Fifth, the `API.appendChatMessage` function could create arbitrary pads because it lacked a `getPadSafe` check. This side effect has been corrected by requiring the target pad to exist before appending a chat message. Finally, the admin file server was disclosing detailed filesystem error information (CWE-209). The fix replaces these detailed errors with a generic message to prevent information leakage.
DailyCVE Form:
Platform: Etherpad
Version: <3.3.0
Vulnerability: CWE-330/CWE-208/CWE-307/CWE-22/CWE-235/CWE-209
Severity: Medium
date: 2026-08-18
Prediction: Already Patched (3.3.0)
What Undercode Say:
Check current Etherpad version npm list ep_etherpad-lite Verify if vulnerable to GHSA-92hr-gmr6-h8cp Affected versions: < 3.3.0
Exploit: (Educational Purposes!)
While specific exploit chains are complex, the weaknesses are understood:
1. Token Prediction (CWE-330): An attacker could observe generated IDs and, knowing they are produced by Math.random(), potentially predict future tokens.
2. Timing Attack (CWE-208): By measuring the response time of login attempts, an attacker could brute-force passwords more efficiently.
3. Path Traversal (CWE-22): A malicious admin (or an attacker who has achieved admin privileges) could craft a plugin with a dependency name like `../../sensitive-file` to read arbitrary files.
4. Parameter Pollution (CWE-235): An attacker could send a request to `/api/2` with malicious headers that might override internal API parameters.
Protection:
- Upgrade to Etherpad version 3.3.0 or later immediately.
- If immediate upgrade is not possible, backport the fixes from PR 7906.
- Restrict admin access to only trusted users as a defense-in-depth measure.
Impact:
Successful exploitation could lead to session hijacking, unauthorized data access, privilege escalation, and information disclosure, compromising the confidentiality and integrity of the collaborative editing environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
