Junglewise Threat Intelligence

CVE-2023-2850: NodeBB cross-origin WebSocket session hijacking

CVE-2023-2850 · Severity: low · CVSS 3.1 · Published 2023-07-25

Technologies: NodeBB. Vendors: NodeBB.

Executive brief

NodeBB is a popular Node.js-based forum platform that uses WebSockets for real-time communication between the server and clients. An attacker can hijack a user's WebSocket session by tricking them into visiting a malicious website while they are logged into a NodeBB forum. This allows the attacker to intercept and read the victim's private messages and posts without requiring valid credentials.

Technical details

The vulnerability is a missing origin validation flaw (CWE-1385, CWE-346) in the WebSocket handshake process. NodeBB did not validate CSRF tokens during WebSocket connection establishment, allowing cross-origin requests to hijack active sessions. An attacker on a different domain can initiate a WebSocket connection to the target NodeBB server using the victim's authenticated browser session (which automatically includes the session cookie). The fix involves sending a CSRF token as a query parameter during the WebSocket handshake and validating it server-side to ensure the connection originates from the legitimate NodeBB domain. No user interaction beyond visiting a malicious page is required to trigger the vulnerability; the attack is performed automatically via JavaScript.

Affected products

  • NodeBB NodeBB 3.0.0 - 3.1.2, < 2.8.13

Timeline

  • 2023-07-25: disclosed: Vulnerability publicly disclosed
  • 2023-05-15: patched: Fixed in NodeBB v3.1.3 and v2.8.13

References

Related threats