CVE-2025-66629
📋 TL;DR
HedgeDoc versions before 1.10.4 have CSRF vulnerabilities in OAuth2 endpoints for social login providers like Google, GitHub, GitLab, Facebook, and Dropbox. Attackers can trick authenticated users into performing unintended OAuth2 authorization actions. All HedgeDoc instances using social login with affected versions are vulnerable.
💻 Affected Systems
- HedgeDoc
📦 What is this software?
Hedgedoc by Hedgedoc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could link their own social accounts to victim accounts, potentially gaining unauthorized access or performing account takeover through social login.
Likely Case
Attackers could associate their social accounts with victim accounts, causing confusion and potential unauthorized access.
If Mitigated
With proper CSRF protection, OAuth2 flows would be secure and only intentional authorizations would succeed.
🎯 Exploit Status
Exploitation requires tricking authenticated users into visiting malicious pages while logged into HedgeDoc.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.4
Vendor Advisory: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6wm6-3vpq-6qvv
Restart Required: Yes
Instructions:
1. Backup your HedgeDoc instance. 2. Update to version 1.10.4 or later using your package manager or deployment method. 3. Restart the HedgeDoc service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Social Login
allTemporarily disable OAuth2 social login providers until patching is complete.
Edit HedgeDoc configuration to remove or comment out OAuth2 provider settings
🧯 If You Can't Patch
- Implement web application firewall rules to detect and block CSRF attempts
- Use browser security extensions that provide CSRF protection
🔍 How to Verify
Check if Vulnerable:
Check HedgeDoc version: if version is less than 1.10.4 and social login is enabled, the system is vulnerable.Check Version:
Check HedgeDoc web interface or run appropriate command for your deployment methodVerify Fix Applied:
Verify HedgeDoc version is 1.10.4 or higher and test OAuth2 login flows work correctly.📡 Detection & Monitoring
Log Indicators:
- Multiple OAuth2 authorization requests from same user in short time
- OAuth2 authorization requests without proper referrer headers
Network Indicators:
- HTTP POST requests to OAuth2 endpoints without CSRF tokens
- Cross-origin requests to HedgeDoc OAuth2 endpoints
SIEM Query:
source="hedgedoc" AND (uri_path="/auth/*" OR uri_path="/oauth2/*") AND http_method="POST" AND NOT csrf_token=*