Executive brief
NodeBB is a forum and discussion platform. An attacker could inject malicious JavaScript code into posts via specially-crafted markdown, and any visitor viewing the post would execute that code in their browser. This could allow account takeover, credential theft, or malware distribution to forum users.
Technical details
Multiple cross-site scripting (XSS) vulnerabilities exist in NodeBB's markdown processing engine, allowing injection of arbitrary HTML and JavaScript through javascript: and data: URL schemes. The vulnerability is present in the markdown-it library used by NodeBB; attackers can inject payloads such as image tags with malicious URLs that execute when the post is rendered. The attack requires no authentication (public posts are viewable by all) and succeeds when a visitor views the crafted post. NodeBB versions before 0.7 and nodebb-plugin-markdown before 5.1.1 are affected. Patches are available in the fixed versions.
Affected products
- NodeBB NodeBB before 0.7
- NodeBB nodebb-plugin-markdown before 5.1.1
Timeline
- 2014-10-16: disclosed
- 2017-09-21: advisory: NVD published CVE-2015-3296
- 2015: patched: NodeBB 0.7 and nodebb-plugin-markdown 5.1.1 fix the issue