Executive brief
NodeBB is a popular open-source forum and community platform. A path traversal vulnerability in its translator module allowed users to access JSON configuration files outside the intended language directory, potentially exposing sensitive application data or configurations. The vulnerability affected versions 1.0.4 through 1.18.4 and has been patched in version 1.18.5.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the translator module that fails to properly validate user-supplied input when constructing file paths. An authenticated user could exploit this to access JSON files located outside the restricted languages/ directory by using path traversal sequences in the translator module's input. The attack requires authentication and network access to the NodeBB instance. An attacker can achieve unauthorized file read access to JSON files, potentially exposing configuration data or other sensitive information. The fix was applied in version 1.18.5; users can also cherry-pick commit c8b2fc46dc698db687379106b3f01c71b80f495f.
Affected products
- NodeBB NodeBB 1.0.4 - 1.18.4
Timeline
- 2021-11-30: disclosed: Published on GitHub Security Advisories
- 2021-11-30: patched: Fixed in NodeBB v1.18.5