PT-2023-4083 · Nodebb · Nodebb

Julianlam + 1 · Publicado 2023-07-24 · Atualizado 2023-09-26 · CVE-2023-26045

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NodeBB versions 2.5.0 through 2.8.7

Description The issue arises due to the use of object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability. This allows a specially crafted payload to invoke the user export logic and arbitrarily execute javascript files on the local disk.

Recommendations For NodeBB versions 2.5.0 through 2.8.7, update to version 2.8.7 to patch the exploit. As a temporary workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-04383

CVE-2023-26045

GHSA-VH2G-6C4X-5HMP

Produtos afetados

Nodebb

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26045.json · Exploit
• https://github.com/NodeBB/NodeBB · Nota
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmp · Aviso do Fabricante
• https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092 · Correção
• https://t.me/cibsecurity/67191 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26045 · Nota de Segurança
• https://security.netapp.com/advisory/ntap-20230831-0004 · Nota
• https://twitter.com/dhakal_ananda/status/1706599777650233456 · Publicação no Twitter
• https://t.me/cybersecuritytechnologies/8742 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-vh2g-6c4x-5hmp · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26045 · Nota
• https://bdu.fstec.ru/vul/2023-04383 · Nota de Segurança
• https://t.me/pentestingnews/37981 · Publicação no Telegram
• https://vuldb.com/?id.235273 · Nota
• https://t.me/cvenotify/55070 · Publicação no Telegram