CyberRota Analysis
AI-GeneratedEtherpad versions prior to 3.3.1 are vulnerable to a critical cross-site scripting (XSS) flaw, allowing users with write access to inject malicious markup that executes when other users, including administrators, view the pad. This vulnerability arises from improper handling of user-controlled attributes in the markup generation process. Organizations using Etherpad should prioritize upgrading to version 3.3.1 to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.