Executive brief
NodeBB is a community forum and discussion platform. A prototype pollution vulnerability in the file uploader module allows a malicious user to inject malicious JavaScript code into the web page, potentially leading to account takeover when combined with other vulnerabilities. This could allow an attacker to compromise user accounts and access sensitive forum data.
Technical details
A prototype pollution vulnerability in NodeBB's uploader module allows an authenticated attacker to inject arbitrary data (including JavaScript) into the DOM via improper handling of object prototype attributes. The vulnerability requires user interaction (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes). When leveraged alongside a path traversal vulnerability, this can escalate to account takeover. The flaw was patched in version 1.18.5; affected versions are 1.15.5 through 1.18.4. Patches are available via upgrade or cherry-picking commit 1783f918bc19568f421473824461ff2ed7755e4c.
Affected products
- NodeBB NodeBB 1.15.5 through 1.18.4
Timeline
- 2021-11-30: disclosed: Advisory GHSA-wx69-rvg3-x7fc published
- 2021-11-30: patched: Fixed in NodeBB v1.18.5