CVE-2021-43787: XSS via prototype pollution in NodeBB
Summary
CVE-2021-43787: XSS via prototype pollution in NodeBB. Affects nodebb versions >= 1.15.0, < 1.18.5. Fixed in 1.18.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NodeBB is an open-source forum software built on Node.js and MongoDB. It provides a platform for creating online communities and discussion boards. The uploader module in NodeBB allows users to upload files and images to the forum. However, a vulnerability in the uploader module allowed an attacker to perform a prototype pollution attack, injecting arbitrary data (such as JavaScript) into the Document Object Model (DOM). This vulnerability could potentially lead to an account takeover when combined with a path traversal vulnerability.
Vulnerability Detail
The prototype pollution vulnerability in the uploader module of NodeBB allowed an attacker to manipulate the prototype of objects, leading to arbitrary code execution. By injecting malicious JavaScript code into the DOM, an attacker could perform actions on behalf of the user, potentially compromising their account. This vulnerability has a CVSS score of 9.0, indicating a critical severity level.
How To Fix
Minimum fixed version
1.18.5
This is the first release that contains the fix.
npm install nodebb@1.18.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately upgrade or apply the patch, you can mitigate the risk by temporarily disabling the uploader module or implementing input validation and sanitization to prevent the injection of malicious data. However, it is strongly advised to apply the official patch or upgrade to the latest version as soon as possible.
Conclusion
The prototype pollution vulnerability in NodeBB's uploader module allowed an attacker to inject arbitrary data into the DOM, potentially leading to an account takeover. It is crucial to upgrade to the patched version or apply the provided fix as soon as possible to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodebb →
FAQ
NodeBB is an open-source forum software built on Node.js and MongoDB. It provides a platform for creating online communities and discussion boards.
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of objects, leading to unexpected behavior or arbitrary code execution.
This vulnerability allows an attacker to inject arbitrary data, such as JavaScript code, into the DOM. When combined with a path traversal vulnerability, it can potentially lead to an account takeover.
You can fix this vulnerability by upgrading NodeBB to version 1.18.5 or later. Alternatively, you can apply the patch by cherry-picking the commit hash 1783f918bc19568f421473824461ff2ed7755e4c.
If you are unable to immediately upgrade or apply the patch, you can mitigate the risk by temporarily disabling the uploader module or implementing input validation and sanitization.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodebb.
