Is CVE-2018-6835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-6835 being exploited in the wild.

How severe is CVE-2018-6835?

Low severity, with a CVSS score of 3, published 13 May 2022.

Which products and versions are affected?

Etherpad Lite before 1.6.3; ep_etherpad-lite (npm) SEMVER:introduced=0,fixed=1.6.3.

Is there a fix for CVE-2018-6835?

Yes. ep_etherpad-lite (npm): upgrade to 1.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-6835 attacked?

It is attacked over the network.

Am I affected by CVE-2018-6835?

Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-6835: Etherpad Lite access restriction bypass in JSONP handling

CVE-2018-6835 · Severity: low · CVSS 3 · Published 2022-05-13

Etherpad Lite is a real-time collaborative text editor. A flaw in JSONP request handling allows remote attackers to bypass access controls and gain unauthorized access to pads and their content. An attacker can exploit this without authentication or special privileges to read or modify collaborative documents.

Technologies: ep_etherpad-lite (npm). Vendors: npm.

Quick answers

Is CVE-2018-6835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-6835 being exploited in the wild.
How severe is CVE-2018-6835?: Low severity, with a CVSS score of 3, published 13 May 2022.
Which products and versions are affected?: Etherpad Lite before 1.6.3; ep_etherpad-lite (npm) SEMVER:introduced=0,fixed=1.6.3.
Is there a fix for CVE-2018-6835?: Yes. ep_etherpad-lite (npm): upgrade to 1.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-6835 attacked?: It is attacked over the network.
Am I affected by CVE-2018-6835?: Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ep_etherpad-lite (npm): upgrade to 1.6.3 or later
```
npm install ep_etherpad-lite@1.6.3
```

Technical details

The vulnerability exists in node/hooks/express/apicalls.js in Etherpad Lite versions before 1.6.3 due to improper sanitization of JSONP callbacks. JSONP is a technique that allows cross-origin requests by wrapping responses in a function call. The vulnerability allows attackers to craft malicious JSONP requests that bypass intended access restrictions on API calls. An attacker can remotely exploit this over the network without requiring authentication or user interaction. The fix, merged in commit 626e58cc, implements better JSONP sanitization. Versions 1.6.3 and later resolve this issue.

Affected products

Etherpad Lite before 1.6.3

Identifiers

CVE-2018-6835
GHSA-mvmv-rq2j-97p2

Timeline

2018-02-08: disclosed
1.6.3: patched

References

https://github.com/ether/etherpad-lite/commit/626e58cc5af1db3691b41fca7b06c28ea43141b1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.