The ep_etherpad-lite software allows operators to run behind a reverse proxy that sets the x-proxy-path header to prefix routes. In versions 2.1.0 through 3.0.0, the x-proxy-path header is reflected unsanitized into admin static assets (HTML, JS, CSS) via String.prototype.replaceAll without setting Vary or Cache-Control headers, enabling cache-poisoning XSS attacks against admin users. In version 3.0.0, the x-proxy-path header is concatenated into a Location header for a redirect in the timeslider feature without sufficient sanitization, allowing open redirect attacks via protocol-relative URLs. These vulnerabilities require the attacker to send crafted x-proxy-path headers that reach the Etherpad server, which is normally prevented by hardened reverse proxies. The combined issues are fixed starting from version 3.1.0.

An attacker can cause reflected and cache-poisoning cross-site scripting on the admin interface, potentially allowing theft or manipulation of admin-scoped data if an admin user loads a poisoned cached response. The open redirect vulnerability can be exploited for phishing by redirecting users to attacker-controlled domains. The vulnerabilities do not require authentication to exploit but do require an admin user to interact with the poisoned content. Properly configured reverse proxies that strip or override the x-proxy-path header prevent exploitation.

A fix is available in ep_etherpad-lite version 3.1.0 and later. Operators should upgrade to this version to remediate the vulnerabilities. Deployments behind reverse proxies that strip or override the x-proxy-path header are not exposed. No additional mitigation is required if the proxy is properly configured to prevent client-controlled x-proxy-path headers from reaching the Etherpad server.