GHSA-2jp7-wwpg-3p9w
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
Quick fix
GHSA-2jp7-wwpg-3p9w — ep_etherpad-lite: upgrade to the fixed version with the command below.
npm install ep_etherpad-lite@3.3.0Details
Fix: PR #7905 (ether/etherpad).
`getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `exportHtmlAdditionalTagsWithData` plugin hook into `span data-<k>="<v>"` without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only `author` attributes are validated; `moveOpsToNewPool` -> `AttributePool.putAttrib` stores any value). With a bundled plugin that registers the hook (ep_font_color / ep_font_size), an attribute value such as `" onload="alert(1)` is exported as `<span data-color="" onload="alert(1)">` and served as text/html, yielding stored XSS for any collaborator who opens the export.
Fix: escape the name and value via `Security.escapeHTMLAttribute`. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w [WEB]
- https://github.com/ether/etherpad/pull/7905 [WEB]
- https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1 [WEB]
- https://github.com/ether/etherpad [PACKAGE]
- https://github.com/ether/etherpad/releases/tag/3.3.0 [WEB]