Description

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-19T20:17:17.720Z",
  "pubdate": "2026-08-19T20:17:17.720Z",
  "executiveSummary": "Etherpad contains multiple vulnerabilities involving the unvalidated and unsanitized handling of the attacker-controlled x-proxy-path request header. These flaws allow an attacker to perform cross-site scripting (XSS) via cache poisoning and open redirection.\nThe affected product is Etherpad, specifically versions ranging from 2.1.0 until 3.1.0. Inadequate handling of proxy headers permits the execution of attacker-injected scripts against administrators and facilitates redirection to malicious external hosts.\nThe risk implications are significant, as successful exploitation compromises administrative sessions and leads to unauthorized external redirections. Attacker capabilities include injecting arbitrary HTML, JavaScript, and CSS into administrative contexts, as well as manipulating timeslider redirect endpoints.\nExploitation requires a deployment configuration where client-supplied x-proxy-path headers can successfully reach the Etherpad application backend. Additionally, caching mechanisms such as a shared proxy or Content Delivery Network (CDN) are leveraged to serve the poisoned responses to legitimate administrators.",
  "technicalDetails": "The root cause of the vulnerability stems from the direct substitution of the attacker-controlled x-proxy-path request header into HTML, JavaScript, and CSS without proper sanitization, Vary: x-proxy-path headers, or Cache-Control: private, no-store directives.\nThe vulnerable components include src/node/hooks/express/admin.ts, which improperly processes the header for administrative paths, and src/node/hooks/express/specialpages.ts in version 3.0.0, which accepts protocol-relative x-proxy-path values during the construction of the /p/:pad/timeslider redirect.\nAffected versions include Etherpad 2.1.0 up to, but not including, version 3.1.0. The issues are network-exposed wherever client-supplied headers are forwarded to the backend application without intermediary stripping or normalization.\nThe attack flow for the XSS vector proceeds as follows: 1. An attacker sends a crafted HTTP request containing a malicious payload within the x-proxy-path header. 2. Etherpad processes this header in src/node/hooks/express/admin.ts and reflects the unescaped input into administrative HTML, JavaScript, or CSS responses under /admin. 3. Due to the lack of Cache-Control headers and Vary mechanisms, a shared proxy or CDN caches the generated response containing the malicious payload. 4. A legitimate administrator subsequently accesses the affected administrative endpoint. 5. The shared proxy or CDN serves the cached, poisoned response to the administrator, resulting in the execution of attacker-injected script within the administrator's browser context.\nThe attack flow for the redirection vector in version 3.0.0 proceeds as follows: 1. An attacker supplies a protocol-relative URI value in the x-proxy-path header. 2. The application utilizes this value in src/node/hooks/express/specialpages.ts when constructing the redirect for the /p/:pad/timeslider endpoint. 3. The application issues a response that redirects the user to the attacker-controlled host.\nPost-exploitation impact includes session hijacking, unauthorized administrative actions, credential theft via injected scripts, and successful phishing or malware delivery through open redirection mechanisms."
}