PT-2022-23164 · Nodebb · Nodebb Forum

Julianlam · Published 2022-09-02 · Updated 2022-09-16 · CVE-2022-36076

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NodeBB Forum Software versions prior to 1.17.2

Description The issue is caused by an unnecessarily strict conditional in the code handling the first step of the Single Sign-On (SSO) process. This conditional inadvertently rendered the pre-existing logic that added and checked a nonce as opt-in instead of opt-out, re-exposing a vulnerability. A specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process.

Recommendations For NodeBB Forum Software versions prior to 1.17.2, update to version 1.17.2 to fully patch the issue. As a temporary workaround, site maintainers can cherry-pick the patch commit into their codebase to patch the exploit.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-36076

GHSA-XMGG-FX9P-PRQ6

Affected Products

Nodebb Forum

References · 10

• 🔥 https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36076.json · Exploit
• 🔥 https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day · Exploit
• https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4 · Patch
• https://osv.dev/vulnerability/GHSA-xmgg-fx9p-prq6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36076 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36076 · Vendor Advisory
• https://github.com/NodeBB/NodeBB · Note
• https://t.me/cvenotify/35839 · Telegram Post
• https://t.me/cibsecurity/49243 · Telegram Post