CVE-2025-49591
📋 TL;DR
CryptPad versions before 2025.3.0 have a critical 2FA bypass vulnerability. Attackers who obtain user credentials can access accounts even with 2FA enabled by URL-encoding a character in the path parameter. All CryptPad users with 2FA configured are affected.
💻 Affected Systems
- CryptPad
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of any user with 2FA enabled, leading to data theft, unauthorized modifications, and potential lateral movement within the collaboration platform.
Likely Case
Targeted account compromise where attackers use stolen credentials to bypass 2FA protections and access sensitive collaborative documents and communications.
If Mitigated
Limited impact if strong credential hygiene is maintained, but still exposes 2FA-protected accounts to credential-based attacks.
🎯 Exploit Status
Exploitation requires valid user credentials. The bypass technique is simple and well-documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.3.0
Vendor Advisory: https://github.com/cryptpad/cryptpad/security/advisories/GHSA-xq5x-wgcm-3p33
Restart Required: Yes
Instructions:
1. Backup your CryptPad instance. 2. Update to version 2025.3.0 or later. 3. Restart the CryptPad service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Disable 2FA
allTemporarily disable Two-Factor Authentication until patching is complete
Not applicable - configuration change in admin panel
🧯 If You Can't Patch
- Implement network-level access controls to restrict CryptPad access to trusted users only
- Enforce strong password policies and monitor for credential compromise
🔍 How to Verify
Check if Vulnerable:
Check CryptPad version in admin panel or via package manager. If version is below 2025.3.0 and 2FA is enabled, the system is vulnerable.Check Version:
Check package.json or admin interface for version numberVerify Fix Applied:
After updating to 2025.3.0, test 2FA enforcement by attempting login with valid credentials but without 2FA token.📡 Detection & Monitoring
Log Indicators:
- Failed 2FA attempts followed by successful authentication without proper 2FA token
- Authentication requests with URL-encoded path parameters
Network Indicators:
- HTTP requests to authentication endpoints with modified path parameters
- Unusual authentication patterns bypassing 2FA
SIEM Query:
source="cryptpad" AND (event="auth" OR event="login") AND NOT (2fa_token_present="true") AND result="success"🔗 References
- https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/lib/http-worker.js#L356-L364
- https://github.com/cryptpad/cryptpad/commit/0c5d4bbf5e5206d53470ea86a664fa2b703fb611
- https://github.com/cryptpad/cryptpad/commit/f624f9d457d36040f57c7598d98a8b9461b79837
- https://github.com/cryptpad/cryptpad/security/advisories/GHSA-xq5x-wgcm-3p33
