Executive brief
NodeBB is a forum and community platform software. A flaw in its single sign-on (SSO) authentication process could allow an attacker performing a man-in-the-middle (MITM) attack to intercept and hijack another user's login session, resulting in complete account takeover and unauthorized access to that user's account and data.
Technical details
The vulnerability is a CSRF-like flaw (CWE-352) in NodeBB's SSO plugin authentication flow. A strict conditional in the first step of the SSO process inadvertently made nonce validation opt-in rather than opt-out, disabling CSRF protection that should always be active. An attacker positioned for a man-in-the-middle attack (e.g., on the network path) can craft a malicious request to /auth/callback with a valid authorization code to hijack another user's account. The attack requires user interaction (user must click a link or perform SSO login) and network adjacency or control. The vulnerability was patched in NodeBB v1.17.2 and later; affected versions are prior to 1.17.1.
Affected products
- NodeBB NodeBB < 1.17.2
Timeline
- 2022-09-01: disclosed
- 2022-09-16: patched: v1.17.2 released