CVE-2022-46164: NodeBB account takeover via prototype vulnerability

CVE-2022-46164 · Severity: low · CVSS 3.1 · Published 2022-12-05

NodeBB is a popular open-source community forum platform. A prototype pollution vulnerability in its socket.io message handling allows attackers to craft malicious payloads that impersonate other users and take over accounts without requiring authentication. This enables attackers to gain full control of any user account, including administrators, leading to unauthorized access to sensitive forum data, user information, and the ability to perform administrative actions.

Technologies: NodeBB. Vendors: NodeBB.

Quick answers

Is CVE-2022-46164 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-46164 being exploited in the wild.
How severe is CVE-2022-46164?
Low severity, with a CVSS score of 3.1, published 5 December 2022.
Which products and versions are affected?
NodeBB before 2.6.1.
Is there a fix for CVE-2022-46164?
A patch was published on 2022-12-05: patched in version 2.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-46164 attacked?
It is attacked over the network.
Am I affected by CVE-2022-46164?
Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a prototype pollution flaw (CWE-665) in NodeBB's socket.io message handling. A plain object with an unprotected prototype is used during socket.io communications, allowing an attacker to craft specially-crafted JSON payloads that pollute the prototype chain. The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this to impersonate arbitrary users and assume their privileges. The vulnerability was patched in version 2.6.1, and a cherry-pick commit (48d1439) is available for sites unable to upgrade immediately.

Affected products

  • NodeBB NodeBB before 2.6.1

Identifiers

  • CVE-2022-46164
  • GHSA-rf3g-v8p5-p675

Timeline

  • 2022-12-05: disclosed
  • 2022-12-05: patched: patched in version 2.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.