GHSA-2jp7-wwpg-3p9w: XSS
Fix: PR #7905 (ether/etherpad).
getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-<k>="<v>" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only author attributes are validated; moveOpsToNewPool -> AttributePool.putAttrib stores any value). With a bundled plugin that registers the hook (epfontcolor / epfontsize), an attribute value such as " onload="alert(1) is exported as <span data-color="" onload="alert(1)"> and served as text/html, yielding stored XSS for any collaborator who opens the export.
Fix: escape the name and value via Security.escapeHTMLAttribute. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ep_etherpad-liteto a version that resolves this vulnerability.Fixed in 3.3.0 - Upgrade
Upgrade
ether/etherpadto a version that resolves this vulnerability.Patch PR #7905 - Configuration
Ensure any values injected via the ep_font_color / ep_font_size plugin hook and exported by getHTMLFromAtext (src/node/utils/ExportHtml.ts) are escaped for HTML attributes using Security.escapeHTMLAttribute (escape the attribute name and attribute value).
Security.escapeHTMLAttribute usage HTML attribute escaping for exported attribute values = Use Security.escapeHTMLAttribute to escape both name and value before interpolation into span data-<k>="<v>" - Operational
Review and address the defense-in-depth startup warning behavior added in PR #7905: investigate/replace any default/placeholder account or SSO credentials that are configured, to reduce risk while the stored XSS fix is deployed.
Event History
Frequently Asked Questions
What is the severity of GHSA-2jp7-wwpg-3p9w?
The severity of GHSA-2jp7-wwpg-3p9w is rated as 65.
How do I fix GHSA-2jp7-wwpg-3p9w?
To fix GHSA-2jp7-wwpg-3p9w, update to the latest version of npm/ep_etherpad-lite that includes PR #7905.
What type of vulnerability is GHSA-2jp7-wwpg-3p9w?
GHSA-2jp7-wwpg-3p9w is classified as a Cross-Site Scripting (XSS) vulnerability.
What part of the code is affected by GHSA-2jp7-wwpg-3p9w?
GHSA-2jp7-wwpg-3p9w affects the `getHTMLFromAtext` function in `src/node/utils/ExportHtml.ts`.
Who is affected by GHSA-2jp7-wwpg-3p9w?
Users of npm/ep_etherpad-lite who use the `exportHtmlAdditionalTagsWithData` plugin hook are affected by GHSA-2jp7-wwpg-3p9w.