Improperly Controlled Modification of Dynamically-Determined Object Attributes in Etherpad - #VU159242

Vulnerability details

The vulnerability allows a remote user to forge pad ownership, alter pad access controls, and delete pads without the creator's authorization.

The vulnerability exists due to improperly controlled modification of security-sensitive object attributes and database records in ImportEtherpad.setPadRaw() when processing .etherpad imports. A remote user can upload a crafted .etherpad file through POST /p/:pad/import to a pad they can write to, overwriting publicStatus, the revision-zero author, or the deletion-token record to bypass creator-only restrictions, enable public write access, or delete the pad.

The target pad must have fewer than 10 revisions when the import runs.

Affected software

Remediation

External References

• https://github.com/ether/etherpad/security/advisories/GHSA-qq7c-m9pc-7q7v

Related Security Bulletins

• Improperly Controlled Modification of Dynamically-Determined Object Attributes in Etherpad