CyberRota Analysis
AI-GeneratedEtherpad versions prior to 3.1.0 are vulnerable to a local file overwrite attack due to the use of predictable temporary filenames derived from Math.random() in shared world-writable directories. An unprivileged attacker can exploit this flaw by creating a symbolic link to a writable file, allowing them to overwrite it with malicious content during import or export operations. Organizations using affected versions of Etherpad should prioritize upgrading to version 3.1.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.