Executive brief
NodeBB is a popular open-source community forum platform. A prototype pollution vulnerability in its socket.io message handling allows attackers to craft malicious payloads that impersonate other users and take over accounts without requiring authentication. This enables attackers to gain full control of any user account, including administrators, leading to unauthorized access to sensitive forum data, user information, and the ability to perform administrative actions.
Technical details
This vulnerability is a prototype pollution flaw (CWE-665) in NodeBB's socket.io message handling. A plain object with an unprotected prototype is used during socket.io communications, allowing an attacker to craft specially-crafted JSON payloads that pollute the prototype chain. The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this to impersonate arbitrary users and assume their privileges. The vulnerability was patched in version 2.6.1, and a cherry-pick commit (48d1439) is available for sites unable to upgrade immediately.
Affected products
- NodeBB NodeBB before 2.6.1
Timeline
- 2022-12-05: disclosed
- 2022-12-05: patched: patched in version 2.6.1