PT-2021-4176 · Etherpad · Etherpad

Paul Gerste · Published 2021-04-06 · Updated 2021-07-30 · CVE-2021-34816

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Etherpad version 1.8.13

Description The issue is related to an Argument Injection problem in the plugin management of Etherpad, allowing privileged users to execute arbitrary code on the server. This can be achieved by installing plugins from an attacker-controlled source, potentially enabling remote code execution.

Recommendations For Etherpad version 1.8.13, consider restricting plugin installations to trusted sources until a patch is available. As a temporary workaround, limit the privileges of users who can install plugins to minimize the risk of exploitation.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2021-04771

CVE-2021-34816

Affected Products

Etherpad

References · 6

• 🔥 https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2021-34816 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04771 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34816 · Security Note
• https://github.com/ether/etherpad-lite/releases · Note
• https://anti-malware.ru/news/2021-07-14-114534/36415 · Note