Vulnerability: static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.
Vulnerability ID: CVE-2018-6834
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ether/etherpad-lite
Published: 2018-02-08
File: src/static/js/pad_utils.js
Commit message: Merge pull request #3313 from rhelmer/sanitize-window-location

better sanitize window location in error messages
Commit author: John McLear

Vulnerable version (before fix):
 function setupGlobalExceptionHandler() {         $("#editorloadingbox").css("padding", "10px");         $("#editorloadingbox").css("padding-top", "45px");         $("#editorloadingbox").html("<div style='text-align:left;color:red;font-size:16px;'><b>An error occurred</b><br>The error was reported with the following id: '" + errorId + "'<br><br><span style='color:black;font-weight:bold;font-size:16px'>Please press and hold Ctrl and press F5 to reload this page, if the problem persists please send this error message to your webmaster: </span><div style='color:black;font-size:14px'>'"           + "ErrorId: " + errorId + "<br>URL: " + window.location.href + "<br>UserAgent: " + userAgent + "<br>" + msg + " in " + url + " at line " + linenumber + "'</div></div>");       }        //send javascript errors to the server

Fixed version (after fix):
 function setupGlobalExceptionHandler() {         $("#editorloadingbox").css("padding", "10px");         $("#editorloadingbox").css("padding-top", "45px");         $("#editorloadingbox").html("<div style='text-align:left;color:red;font-size:16px;'><b>An error occurred</b><br>The error was reported with the following id: '" + errorId + "'<br><br><span style='color:black;font-weight:bold;font-size:16px'>Please press and hold Ctrl and press F5 to reload this page, if the problem persists please send this error message to your webmaster: </span><div style='color:black;font-size:14px'>'"           + "ErrorId: " + errorId + "<br>URL: " + padutils.escapeHtml(window.location.href) + "<br>UserAgent: " + userAgent + "<br>" + msg + " in " + url + " at line " + linenumber + "'</div></div>");       }        //send javascript errors to the server

Patch:
patch: @@ -524,7 +524,7 @@ function setupGlobalExceptionHandler() {
         $("#editorloadingbox").css("padding", "10px");
         $("#editorloadingbox").css("padding-top", "45px");
         $("#editorloadingbox").html("<div style='text-align:left;color:red;font-size:16px;'><b>An error occurred</b><br>The error was reported with the following id: '" + errorId + "'<br><br><span style='color:black;font-weight:bold;font-size:16px'>Please press and hold Ctrl and press F5 to reload this page, if the problem persists please send this error message to your webmaster: </span><div style='color:black;font-size:14px'>'"
-          + "ErrorId: " + errorId + "<br>URL: " + window.location.href + "<br>UserAgent: " + userAgent + "<br>" + msg + " in " + url + " at line " + linenumber + "'</div></div>");
+          + "ErrorId: " + errorId + "<br>URL: " + padutils.escapeHtml(window.location.href) + "<br>UserAgent: " + userAgent + "<br>" + msg + " in " + url + " at line " + linenumber + "'</div></div>");
       }
 
       //send javascript errors to the server
path: src/static/js/pad_utils.js