Executive brief
NukeViet, an open-source content management system, contains a vulnerability in its comment module that allows attackers to execute malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login credentials or perform actions on the user's behalf. This is made easier by a secondary flaw where security tokens meant to prevent such attacks are not unique to each user, allowing them to be easily predicted or reused.
Technical details
The vulnerability consists of two flaws in the NukeViet Comment module. First, the 'status_comment' parameter is sanitized before being base64-decoded, allowing encoded HTML/JavaScript payloads to bypass filters and execute in the victim's browser when rendered unescaped. Second, the 'checkss' anti-forgery token is derived from a site-wide static constant ('NV_CACHE_PREFIX') rather than a per-session value, making it predictable and reusable across different users. An unauthenticated attacker can obtain a valid 'checkss' token from the public HTML and construct a malicious URL that, when visited by a victim, executes arbitrary JavaScript. This can lead to credential theft via phishing overlays or session hijacking. The issue is fixed in version 4.6.00 by binding tokens to user sessions and escaping output before rendering.
Affected products
- NukeViet NukeViet < 4.5.09
Timeline
- 2026-07-13: advisory: GitHub Advisory GHSA-mxpf-qgg6-v3ff published
- 2026-07-13: disclosed