CVE-2021-29475
📋 TL;DR
CVE-2021-29475 is a critical file disclosure vulnerability in HedgeDoc (formerly CodiMD) where attackers can read arbitrary files from the filesystem when exporting notes to PDF. This affects all HedgeDoc instances with PDF export enabled, requiring the attacker to have note modification privileges. The vulnerability allows exfiltration of sensitive configuration files containing credentials and secrets.
💻 Affected Systems
- HedgeDoc
- CodiMD
📦 What is this software?
Hedgedoc by Hedgedoc
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the HedgeDoc instance with theft of database credentials, OAuth secrets, and other sensitive files from the server filesystem, potentially leading to further system compromise.
Likely Case
Exfiltration of the config.json file containing database credentials and application secrets, enabling unauthorized access to the HedgeDoc database and potentially other systems using the same credentials.
If Mitigated
No file disclosure if PDF export is disabled or the system is patched, though other vulnerabilities in the application could still pose risks.
🎯 Exploit Status
Exploit requires ability to modify note content and PDF export to be enabled. The advisory includes technical details of the exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0
Vendor Advisory: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-pxxg-px9v-6qf3
Restart Required: Yes
Instructions:
1. Upgrade HedgeDoc to version 1.5.0 or later. 2. Restart the HedgeDoc service. 3. Verify PDF export functionality if needed for your use case.
🔧 Temporary Workarounds
Disable PDF Export
allDisable PDF export functionality to prevent exploitation of this vulnerability
CMD_ALLOW_PDF_EXPORT=false
Configuration File Modification
allSet allowPDFExport to false in config.json
Set "allowPDFExport": false in config.json
🧯 If You Can't Patch
- Immediately disable PDF export via environment variable or configuration file
- Restrict note editing permissions to trusted users only
🔍 How to Verify
Check if Vulnerable:
Check if HedgeDoc version is below 1.5.0 and PDF export is enabled in configuration or environment variables.Check Version:
Check the HedgeDoc web interface footer or application logs for version informationVerify Fix Applied:
Verify HedgeDoc version is 1.5.0 or higher and test that PDF export either works securely or is disabled as intended.📡 Detection & Monitoring
Log Indicators:
- Unusual PDF export requests, especially with file:// URLs in note content
- Multiple failed PDF generation attempts
Network Indicators:
- Unexpected outbound data transfers following PDF export operations
SIEM Query:
source="hedgedoc" AND ("pdf export" OR "phantomjs") AND ("file://" OR "config.json")🔗 References
- https://github.com/hedgedoc/hedgedoc/commit/c1789474020a6d668d616464cb2da5e90e123f65
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-pxxg-px9v-6qf3
- https://github.com/hedgedoc/hedgedoc/commit/c1789474020a6d668d616464cb2da5e90e123f65
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-pxxg-px9v-6qf3
