Critical Flaws Reported in Etherpad — a Popular Google Docs Alternative

guest · Jul 13, 2021

Critical Flaws Reported in Etherpad — a Popular Google Docs Alternative
July 13, 2021
https://thehackernews.com/2021/07/critical-flaws-reported-in-etherpad.html

Cybersecurity researchers have disclosed new security vulnerabilities in the Etherpad text editor (version 1.8.13) that could potentially enable attackers to hijack administrator accounts, execute system commands, and even steal sensitive documents.

The two flaws — tracked as CVE-2021-34816 and CVE-2021-34817 — were discovered and reported on June 4 by researchers from SonarSource, following which patches have been shipped for the latter in version 1.8.14 of Etherpad released on July 4.

"The XSS vulnerability allows attackers to take over Etherpad users, including admins. This can be used to steal or manipulate sensitive data," SonarSource vulnerability researcher Paul Gerste said in a report shared with The Hacker News.
Concerningly, both vulnerabilities can be chained together by an attacker first to take over an administrator account and then use those privileges to gain a shell and execute malicious code on the server.
Click to expand...

Log in or Sign up

Critical Flaws Reported in Etherpad — a Popular Google Docs Alternative

guest Guest

Log in or Sign up

Critical Flaws Reported in Etherpad — a Popular Google Docs Alternative

guest Guest

Useful Searches