Account takeover in NodeBB
CVE-2020-15149

9.9CRITICAL

Key Information:

Vendor

Nodebb

Status
Nodebb
Vendor
CVE Published:
20 August 2020

What is CVE-2020-15149?

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.

Affected Version(s)

NodeBB >=12.2.2, < 1.14.3

References

https://github.com/NodeBB/NodeBB/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5f...
x_refsource_MISC
https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exp...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.