Executive brief
ep_imageconvert is a plugin for the Etherpad Lite collaborative editor that handles server-side image scaling and PDF conversion. A security flaw allows an unauthenticated attacker to execute arbitrary commands on the server hosting the editor. This could lead to a complete system takeover, unauthorized access to sensitive documents, or disruption of the editing service.
Technical details
The ep_imageconvert plugin (versions 0.0.2 and earlier) for Etherpad Lite is vulnerable to remote command injection. The vulnerability stems from the use of the `child_process.exec` function in Node.js to handle image and PDF processing tasks (such as scaling and tiling) without sufficient sanitization of input. An unauthenticated remote attacker can exploit this by sending crafted requests that inject shell commands into the system calls. The issue was resolved by migrating from `child_process.exec` to `child_process.execFile`, which prevents shell injection by treating arguments as literal strings rather than shell commands. Users should update to version 0.0.3 or later.
Affected products
- Etherpad Lite ep_imageconvert <= 0.0.2
Timeline
- 2013-05-06: disclosed: Vulnerability identified/reported via Snyk/NPM advisory
- 2013-07-09: patched: Fix merged into master branch via pull request #5
- 2020-08-31: advisory: GitHub Advisory published