-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ep_etherpad-lite | npm | < 1.6.3 | 1.6.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the JSONP handling logic. The key evidence is in the commit diff showing the addition of 'isVarName(response)' validation to the JSONP conditional. Before patching, the code only checked for the presence of 'req.query.jsonp' without validating if it was a safe JavaScript identifier. This allowed attackers to inject arbitrary callback functions through the jsonp parameter, bypassing same-origin policy restrictions and enabling data exfiltration. The apiCaller function's direct concatenation of user input into the response without proper validation matches CWE-20's characteristics of improper input validation.