Vulnerability · Published Nov 29, 2021 · Assigned by GitHub_M

CVE-2021-43787XSS via prototype pollution

Critical 9.0

In plain English

A critical-severity cross-site scripting in NodeBB from NodeBB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)1.3%top 29.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	nodebb	1.18.5	GHSA-wx69-rvg3-x7fc

Affected products (as reported)

Vendor	Product	Versions
NodeBB	NodeBB	>= 1.15.5, < 1.18.5

Weakness: CWE-79, CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fc x_refsource_CONFIRM
https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4c x_refsource_MISC
https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5 x_refsource_MISC
https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/ x_refsource_MISC