ep_etherpad-lite 1.8.14

Direct Vulnerabilities

Known vulnerabilities in the ep_etherpad-lite package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Insufficient Entropy in PRNG ep_etherpad-lite is a modern really-real-time collaborative document editor. Affected versions of this package are vulnerable to Insufficient Entropy in PRNG through the `ImportHandler` and `ExportHandler` in `src/node/handler/ImportHandler.ts` and `src/node/handler/ExportHandler.ts`. An attacker can overwrite files the Etherpad process can write by predicting a temp filename and planting a symlink in the shared `/tmp` directory before an import or export runs. The handlers derive temp-file path tokens from `Math.random()`, making the filenames guessable on a multi-tenant host. When the process writes or renames the temporary export/import file, it follows the attacker’s symlink and clobbers the linked target, which can corrupt data or overwrite sensitive files accessible to the Etherpad account. How to fix Insufficient Entropy in PRNG? A fix was pushed into the `master` branch but not yet published.	*
H Privilege Escalation ep_etherpad-lite is a modern really-real-time collaborative document editor. Affected versions of this package are vulnerable to Privilege Escalation. An attacker can craft an `.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute arbitrary code (including system commands). To gain privileges, the attacker must be able to trigger deletion of `express-session` state or wait for old `express-session` state to be cleaned up. Core Etherpad does not delete any `express-session` state, so the only known attacks require either a plugin that can delete session state or a custom cleanup process (such as a cron job that deletes old `sessionstorage:` records). If users cannot upgrade to the fixed version or install patches manually, several workarounds are available. Users may configure their reverse proxies to reject requests to `/p//import`, which will block all imports, not just `.etherpad` imports; limit all users to read-only access; and/or prevent the reuse of `express_sid` cookie values that refer to deleted express-session state. How to fix Privilege Escalation? A fix was pushed into the `master` branch but not yet published.	*

Vulnerability

Vulnerable Version

Insufficient Entropy in PRNG

ep_etherpad-lite is a modern really-real-time collaborative document editor.

Affected versions of this package are vulnerable to Insufficient Entropy in PRNG through the ImportHandler and ExportHandler in src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts. An attacker can overwrite files the Etherpad process can write by predicting a temp filename and planting a symlink in the shared /tmp directory before an import or export runs. The handlers derive temp-file path tokens from Math.random(), making the filenames guessable on a multi-tenant host. When the process writes or renames the temporary export/import file, it follows the attacker’s symlink and clobbers the linked target, which can corrupt data or overwrite sensitive files accessible to the Etherpad account.

How to fix Insufficient Entropy in PRNG?

A fix was pushed into the master branch but not yet published.

Privilege Escalation

ep_etherpad-lite is a modern really-real-time collaborative document editor.

Affected versions of this package are vulnerable to Privilege Escalation. An attacker can craft an *.etherpad file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute arbitrary code (including system commands).

To gain privileges, the attacker must be able to trigger deletion of express-session state or wait for old express-session state to be cleaned up. Core Etherpad does not delete any express-session state, so the only known attacks require either a plugin that can delete session state or a custom cleanup process (such as a cron job that deletes old sessionstorage:* records).

If users cannot upgrade to the fixed version or install patches manually, several workarounds are available. Users may configure their reverse proxies to reject requests to /p/*/import, which will block all imports, not just *.etherpad imports; limit all users to read-only access; and/or prevent the reuse of express_sid cookie values that refer to deleted express-session state.

How to fix Privilege Escalation?

A fix was pushed into the master branch but not yet published.

ep_etherpad-lite@1.8.14

A free and open source realtime collaborative editor

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically