CyberRota Analysis
AI-GeneratedEtherpad versions prior to 3.3.0 are vulnerable to cross-site scripting (XSS) due to improper HTML attribute escaping in the getHTMLFromAtext function, allowing an attacker to inject malicious scripts through user-controlled values in span data attributes. This vulnerability can lead to the execution of arbitrary scripts when exported HTML is opened, potentially compromising user data and session integrity. Organizations using Etherpad, especially those utilizing bundled plugins like ep_font_color or ep_font_size, should prioritize upgrading to version 3.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.