CVE-2021-43802
📋 TL;DR
CVE-2021-43802 is a critical vulnerability in Etherpad that allows attackers to gain admin privileges by importing a malicious *.etherpad file. This can lead to arbitrary code execution through malicious plugin installation. All Etherpad instances prior to version 1.8.16 are affected.
💻 Affected Systems
- Etherpad
📦 What is this software?
Etherpad by Etherpad
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining admin privileges, installing malicious plugins, and executing arbitrary system commands on the server.
Likely Case
Administrative takeover of Etherpad instance leading to data theft, manipulation, or service disruption.
If Mitigated
Limited impact if import functionality is disabled or proper session management controls are in place.
🎯 Exploit Status
Attack requires ability to trigger deletion of express-session state or wait for cleanup. Core Etherpad doesn't delete session state by default.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.16
Vendor Advisory: https://github.com/ether/etherpad-lite/security/advisories/GHSA-w3g3-qf3g-2mqc
Restart Required: Yes
Instructions:
1. Backup your Etherpad instance. 2. Update to version 1.8.16 or later. 3. Restart the Etherpad service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Block Import Endpoint
allConfigure reverse proxy to reject requests to /p/*/import endpoint
# Example nginx config: location ~ ^/p/.*/import$ { return 403; }
# Example Apache config: <LocationMatch "^/p/.*/import$"> Require all denied </LocationMatch>
Read-Only Access
allLimit all users to read-only access to prevent import functionality
# Configure in settings.json: "requireAuthentication": true, "requireAuthorization": true, "editOnly": false
🧯 If You Can't Patch
- Configure reverse proxy to block /p/*/import requests
- Implement strict session management to prevent reuse of deleted session IDs
🔍 How to Verify
Check if Vulnerable:
Check Etherpad version: if version < 1.8.16, system is vulnerableCheck Version:
Check package.json or run: node -e "console.log(require('./src/package.json').version)" from Etherpad directoryVerify Fix Applied:
Verify version is 1.8.16 or later and test import functionality is properly secured📡 Detection & Monitoring
Log Indicators:
- Unusual import requests to /p/*/import
- Session ID reuse patterns
- Admin privilege escalation events
Network Indicators:
- Requests to import endpoints with *.etherpad files
- Unusual plugin installation activity
SIEM Query:
source="etherpad" AND (uri="/p/*/import" OR message="admin privilege" OR message="plugin install")🔗 References
- https://github.com/ether/etherpad-lite/compare/b7065eb9a0ec7c3c265f8cfeb2534efe6f036456...77bcb507b30e762e9375b0511b3763e0162aae53
- https://github.com/ether/etherpad-lite/issues/5010
- https://github.com/ether/etherpad-lite/releases/tag/1.8.16
- https://github.com/ether/etherpad-lite/security/advisories/GHSA-w3g3-qf3g-2mqc
- https://github.com/ether/etherpad-lite/compare/b7065eb9a0ec7c3c265f8cfeb2534efe6f036456...77bcb507b30e762e9375b0511b3763e0162aae53
- https://github.com/ether/etherpad-lite/issues/5010
- https://github.com/ether/etherpad-lite/releases/tag/1.8.16
- https://github.com/ether/etherpad-lite/security/advisories/GHSA-w3g3-qf3g-2mqc
