PT-2022-16912 · Hedgedoc · Hedgedoc

Jimmywarting · Published 2022-04-11 · Updated 2022-04-19 · CVE-2022-24837

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HedgeDoc versions 1.9.1 through 1.9.2

Description HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur.

Recommendations For HedgeDoc versions 1.9.1 and 1.9.2, upgrade to version 1.9.3 to patch the issue by replacing the filename generation with UUIDv4. As a temporary workaround for versions 1.9.1 and 1.9.2, consider blocking POST requests to "/uploadimage" to disable future uploads.

Exploit

Fix

Information Disclosure

Unrestricted File Upload

Weakness Enumeration

CWE-200

CWE-434

Related Identifiers

CVE-2022-24837

GHSA-Q6VV-2Q26-J7RX

Affected Products

Hedgedoc

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24837.json · Exploit
• https://github.com/hedgedoc/hedgedoc/commit/9e2f9e21e904c4a319e84265da7ef03b0a8e343a · Patch
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-q6vv-2q26-j7rx · Patch
• https://osv.dev/vulnerability/CVE-2022-24837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24837 · Security Note
• https://github.com/node-formidable/formidable/issues/808 · Note
• https://t.me/cibsecurity/40543 · Telegram Post