PT-2021-23944 · Etherpad+1 · Etherpad+1
Rhansen
·
Published
2021-12-09
·
Updated
2023-08-31
·
CVE-2021-43802
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Etherpad versions prior to 1.8.16
Description:
Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an
*.etherpad file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute arbitrary code, including system commands. To gain privileges, the attacker must be able to trigger deletion of express-session state or wait for old express-session state to be cleaned up. Core Etherpad does not delete any express-session state, so the only known attacks require either a plugin that can delete session state or a custom cleanup process, such as a cron job that deletes old sessionstorage:* records.Recommendations:
For versions prior to 1.8.16, upgrade to version 1.8.16 to fix the issue.
As a temporary workaround, consider configuring reverse proxies to reject requests to "/p/*/import" to block all imports.
Limit all users to read-only access to minimize the risk of exploitation.
Prevent the reuse of
express sid cookie values that refer to deleted express-session state.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Etherpad
Express-Session