Executive brief
Etherpad Lite is a real-time collaborative text editor. A flaw in JSONP request handling allows remote attackers to bypass access controls and gain unauthorized access to pads and their content. An attacker can exploit this without authentication or special privileges to read or modify collaborative documents.
Technical details
The vulnerability exists in node/hooks/express/apicalls.js in Etherpad Lite versions before 1.6.3 due to improper sanitization of JSONP callbacks. JSONP is a technique that allows cross-origin requests by wrapping responses in a function call. The vulnerability allows attackers to craft malicious JSONP requests that bypass intended access restrictions on API calls. An attacker can remotely exploit this over the network without requiring authentication or user interaction. The fix, merged in commit 626e58cc, implements better JSONP sanitization. Versions 1.6.3 and later resolve this issue.
Affected products
- Etherpad Lite before 1.6.3
Timeline
- 2018-02-08: disclosed
- 1.6.3: patched