nodebb@0.8.2 vulnerabilities

NodeBB Forum

Direct Vulnerabilities

Known vulnerabilities in the nodebb package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Handling of Unexpected Data Type

nodebb is a package that utilizes web sockets for instant interactions and real-time notifications.

Affected versions of this package are vulnerable to Improper Handling of Unexpected Data Type. An unauthenticated attacker is able to send a malicious Socket.IO message to cause a NodeBB worker instance to crash. Although NodeBB’s cluster manager attempts to spawn a new replacement worker, it is possible to cause the NodeBB cluster manager to terminate after crashing NodeBB workers multiple times within a short span of time.

Note:

The vulnerability can be exploited by using an array as the Socket.IO event name to trigger a crash when invoking eventName.startsWith(), or by using an object as the Socket.IO event name, and setting the toString property, to trigger a crash when invoking eventName.toString().

How to fix Improper Handling of Unexpected Data Type?

A fix was pushed into the master branch but not yet published.

*
  • M
Cross-site Request Forgery (CSRF)

nodebb is a package that utilizes web sockets for instant interactions and real-time notifications.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to the /register/abort endpoint not checking for a CSRF token.

How to fix Cross-site Request Forgery (CSRF)?

A fix was pushed into the master branch but not yet published.

*
  • H
Cryptographic Issues

nodebb is a package that utilizes web sockets for instant interactions and real-time notifications.

Affected versions of this package are vulnerable to Cryptographic Issues due to the usage of insecure pseudo-random number generator Math.random() within the utils.generateUUID function. Exploiting this vulnerability allows an attacker to correctly calculate the reset code for an account they do not have access to, leading to account takeover.

How to fix Cryptographic Issues?

A fix was pushed into the master branch but not yet published.

*
  • H
Prototype Pollution

nodebb is a package that utilizes web sockets for instant interactions and real-time notifications.

Affected versions of this package are vulnerable to Prototype Pollution via the uploader module which allows a malicious user to inject arbitrary data (i.e. javascript) into the DOM. This may lead

How to fix Prototype Pollution?

A fix was pushed into the master branch but not yet published.

*
  • H
Improper Authentication

nodebb is a package that utilizes web sockets for instant interactions and real-time notifications.

Affected versions of this package are vulnerable to Improper Authentication via incorrect logic present in the token verification step which allows master token access to the API.

How to fix Improper Authentication?

A fix was pushed into the master branch but not yet published.

*
  • H
Directory Traversal

nodebb is a package that utilizes web sockets for instant interactions and real-time notifications.

Affected versions of this package are vulnerable to Directory Traversal via the namespace argument given to the function stored in Languages.get.

How to fix Directory Traversal?

A fix was pushed into the master branch but not yet published.

*
  • M
Arbitrary Code Execution

nodebb is a NodeBB Forum. Affected versions of the package are vulnerable to Arbitrary code execution .

How to fix Arbitrary Code Execution?

Upgrade nodebb to version 1.4.1 or higher.

>=0.4.3 <1.4.1