PT-2023-21763 · Nodebb · Nodebb

Mowzk · Published 2023-07-25 · Updated 2023-08-07 · CVE-2023-2850

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NodeBB versions prior to 2.8.13 NodeBB versions prior to 3.1.3

Description The issue is related to a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. This allows certain user information to be extracted by an attacker. Private messages or posts might be leaked to third parties if the victim opens the attacker's site while browsing NodeBB.

Recommendations For NodeBB versions prior to 2.8.13, update to version 2.8.13 or later. For NodeBB versions prior to 3.1.3, update to version 3.1.3 or later. As a temporary workaround for users on v3.x, consider cherry-picking https://github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359. For users running v2.x of NodeBB, consider cherry-picking a5d92da9ddac5607ab7f737520a66eaed6d3ddee followed by 62e162cf1e735e42462be1db9b4954b5a69accdf to mitigate the issue.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

CWE-1385

Related Identifiers

CVE-2023-2850

GHSA-4QCV-QF38-5J3J

Affected Products

Nodebb

References · 11

• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-4qcv-qf38-5j3j · Vendor Advisory
• https://github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-2850 · Security Note
• https://osv.dev/vulnerability/GHSA-4qcv-qf38-5j3j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2850 · Vendor Advisory
• https://github.com/NodeBB/NodeBB · Note
• https://github.com/NodeBB/NodeBB/commit/62e162cf1e735e42462be1db9b4954b5a69accdf · Note
• https://github.com/NodeBB/NodeBB/commit/a5d92da9ddac5607ab7f737520a66eaed6d3ddee · Note
• https://github.com/NodeBB/NodeBB/releases/tag/v3.1.3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2850 · Note
• https://t.me/cibsecurity/67231 · Telegram Post