Listen to this Post
This vulnerability exploits the OAuth2 authorization flow in HedgeDoc’s social login integrations (Google, GitHub, etc.). During login, HedgeDoc did not generate or validate a unique ‘state’ parameter. The ‘state’ parameter is crucial for CSRF protection as it binds the initial authorization request to the subsequent callback response. An attacker can craft a malicious link that initiates an OAuth login to their own controlled application. If a logged-in HedgeDoc user clicks this link, the OAuth provider will complete the authentication flow using the user’s existing session. Without a ‘state’ parameter to verify the request’s origin, the attacker can trick the OAuth provider into returning an authorization code to HedgeDoc, which then logs the attacker into the victim’s HedgeDoc account, effectively achieving account takeover.
Platform: HedgeDoc
Version: Before 1.10.4
Vulnerability: Missing state parameter
Severity: Medium
date: 12/05/2025
Prediction: Patch released 2025-12-05
What Undercode Say:
Example curl to test for missing 'state' parameter in OAuth initiation curl -sI "https://HEDGEDOC_INSTANCE/auth/oauth2/GITHUB" | grep -i "location" Check if the redirect URL contains a 'state' parameter
// Hypothetical malicious page to trigger OAuth flow
window.open('https://hedgedoc-instance.com/auth/oauth2/github?redirect_uri=attacker-controlled-callback');
How Exploit:
Attacker crafts malicious OAuth initiation link. Victim clicks link while logged into HedgeDoc. OAuth provider authenticates victim and returns code to HedgeDoc. HedgeDoc, lacking state validation, accepts code and logs attacker in.
Protection from this CVE
Update to HedgeDoc 1.10.4. Ensure OAuth2 clients always use and validate the ‘state’ parameter. Implement CSRF tokens for all authentication flows.
Impact:
Account takeover via login. Unauthorized access to user notes. Potential data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
