PT-2021-4175 · Etherpad · Etherpad

Rhansen + 1 · Published 2021-04-06 · Updated 2021-07-27 · CVE-2021-34817

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Etherpad version 1.8.13

Description A Cross-Site Scripting (XSS) issue in the chat component of Etherpad allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad. This occurs due to a lack of protection for the web page structure, enabling a remote attacker to execute arbitrary JavaScript or HTML code.

Recommendations For Etherpad version 1.8.13, consider disabling the chat component until a patch is available to prevent the injection of arbitrary JavaScript or HTML code. Restrict access to the chat functionality to minimize the risk of exploitation. Avoid importing crafted pads to the chat component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04770

CVE-2021-34817

Affected Products

Etherpad

References · 10

• 🔥 https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa · Exploit
• https://github.com/ether/etherpad-lite/releases/tag/1.8.14 · Patch
• https://bdu.fstec.ru/vul/2021-04770 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34817 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34817 · Vendor Advisory
• https://etherpad.org/#download · Vendor Advisory
• https://t.me/cibsecurity/26253 · Telegram Post
• https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities · Note
• https://t.me/cvenotify/18199 · Telegram Post
• https://t.me/cvenotify/17833 · Telegram Post