Junglewise Threat Intelligence

Etherpad cryptographic hardening in token generation, authentication, and API handling

Severity: medium · Published 2026-08-17

Executive brief

Etherpad is a real-time collaborative text editor used for shared document editing and notes. The advisory fixes six security weaknesses in how Etherpad generates authentication tokens, compares passwords, loads plugins, and handles API requests. The most critical issues were weak random number generation for session identifiers (allowing token prediction) and timing-attack vulnerabilities in login (allowing attackers to enumerate valid usernames). An attacker with admin access could exploit path traversal to install malicious plugins, and unauthenticated users could inadvertently create new pads or extract filesystem paths through API calls.

Technical details

This advisory addresses six distinct hardening fixes to Etherpad: (1) CWE-330 (weak RNG): Session/author/readonly IDs were generated using client-side and server-side Math.random() instead of cryptographically secure randomness, allowing token prediction. Fixed by migrating to crypto.getRandomValues(). (2) CWE-208/CWE-307 (timing attacks): OIDC login used non-constant-time password comparison without failure delay, leaking valid username information via response time. Fixed by implementing crypto.timingSafeEqual and uniform failure delay. (3) CWE-22 (path traversal): Plugin dependency names from package.json were used to construct filesystem paths without validation, allowing admin-gated exploitation. Fixed by validating names against npm naming grammar. (4) CWE-235 (parameter pollution): RestAPI /api/2 endpoint merged all request headers into the API field set, allowing header injection. Fixed by forwarding only the authorization header. (5) Pad creation side effect: API.appendChatMessage() lacked a pad-existence check, creating pads on demand via chat messages. Fixed by requiring the pad to exist before adding messages. (6) CWE-209 (error disclosure): Admin file server returned detailed filesystem errors. Fixed by returning a generic message server-side. All fixes are present in version 3.3.0; affected versions are ≤1.8.14 (per GitHub API) and ≤3.2.0 (per repository advisory).

Affected products

  • Ether Etherpad <= 1.8.14

Timeline

  • 2026-06-10: disclosed: Advisory published
  • 2026-06-07: patched: Fix merged in PR #7906
  • 2026-06-09: other: Patched version 3.3.0 released

References

Related threats