Executive brief
The NodeBB Blog Comments plugin fails to validate CSRF tokens on comment reply and article publish endpoints. An attacker can craft a malicious webpage that, when visited by a logged-in forum user, causes the user's browser to post comments or articles on their behalf. This allows unauthorized content injection and potential defacement of the forum.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) weakness in the nodebb-plugin-blog-comments plugin affecting versions before 0.7.0. The vulnerable endpoints are POST /comments/reply and POST /comments/publish, which do not apply CSRF middleware (applyCSRF) before processing requests. An attacker can create a malicious web page containing a form or JavaScript that makes requests to these endpoints; when a logged-in user visits that page, their browser automatically includes session cookies, allowing the attacker to post comments or articles impersonating the user. The fix, applied in version 0.7.0, adds the applyCSRF middleware to both endpoints, enforcing CSRF token validation. Authentication is required (user must be logged in), but no additional user interaction is needed beyond visiting a malicious page.
Affected products
- psychobunny nodebb-plugin-blog-comments < 0.7.0
Timeline
- 2020-08-26: disclosed: GHSA-43m5-c88r-cjvv published
- 2020-08-26: patched: Version 0.7.0 released with CSRF fix