CVE-2018-6835

Vulnerability

In Etherpad Lite versions prior to v1.6.3, the file node/hooks/express/apicalls.js mishandles JSONP requests by not validating the callback parameter. The code directly concatenates the req.query.jsonp value into the response without checking whether it is a valid JavaScript variable name. This allows an attacker to inject arbitrary function calls or code, bypassing intended access restrictions [1][2][4].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the Etherpad API endpoint with a jsonp query parameter containing a malicious callback name. No authentication or prior access is required; the attacker only needs network connectivity to the Etherpad instance. The server then returns a response that executes the attacker-controlled callback, potentially triggering unintended actions [2][4].

Impact

Successful exploitation allows a remote attacker to bypass access restrictions, potentially leading to unauthorized data access, information disclosure, or execution of arbitrary operations within the context of the Etherpad API. The exact impact depends on the API functions exposed, but the vulnerability undermines the intended security boundaries [2][4].

Mitigation

The vulnerability is fixed in Etherpad Lite v1.6.3, released on 2018-02-08 [3]. Users should upgrade to v1.6.3 or later immediately. The fix adds a check using isVarName(response) to ensure the callback parameter is a valid JavaScript variable name before including it in the response [4]. No workarounds are documented; upgrading is the recommended action.