CVE-2022-24837 Enumerable upload file names in hedgedoc

What is CVE-2022-24837?

CVE-2022-24837 is a medium-severity vulnerability in hedgedoc, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.

Weakness: CWE-434, CWE-200

Which versions are affected by CVE-2022-24837?

It affects 1 product.

Products include Hedgedoc Hedgedoc.

How do I fix CVE-2022-24837?

No fix has been published for CVE-2022-24837 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-24837 being exploited?

There is no known exploitation of CVE-2022-24837 in the wild and no public exploit code.

Other vulnerabilities in hedgedoc

• CVE-2021-29475 PDF export allows arbitrary file reads Critical 10.0
• CVE-2020-26287 Stored XSS in mermaid diagrams High 8.7
• CVE-2021-39175 XSS vector in slide mode speaker-view High 8.1
• CVE-2021-29503 Improper Neutralization of Script-Related HTML Tags in Notes High 8.1
• CVE-2020-26286 Arbitary file upload High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q6vv-2q26-j7rx.