PT-2020-14227 · Nodebb · Nodebb

Published 2020-08-19 · Updated 2021-11-18 · CVE-2020-15149

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions NodeBB versions 1.12.2 through 1.14.2

Description The issue is related to a bug in the validation logic of NodeBB, which allows an attacker to change the password of any user by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event via an account takeover.

Recommendations For NodeBB versions 1.12.2 through 1.14.2, as a temporary workaround, you may cherry-pick the commit 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a from the project's repository to your running instance of NodeBB. Update to version 1.14.3 to resolve the issue.

Fix

Improper Authentication

Improper Privilege Management

Weakness Enumeration

CWE-287

CWE-269

Related Identifiers

CVE-2020-15149

GHSA-HR66-C8PG-5MG7

Affected Products

Nodebb

References · 6

• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7 · Patch
• https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39 · Patch
• https://osv.dev/vulnerability/CVE-2020-15149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15149 · Security Note
• http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.html · Note
• https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change · Note