by Kastro
Paper/Archive/CVE-2023-26045

CVE-2023-26045

NodeBB NodeBB — NodeBB vulnerable to path traversal and code execution via prototype vulnerability

EPSS 1%CVSS 10.0
critical.is priorityof 100
43
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 63.7.637 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

Affected

ProductAffectedFixed inSource
NodeBB>= 2.5.0, < 2.8.7–CNA
nodebb2.5.0 – < 2.8.72.8.7CISA-ADP

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmprefgithub.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092refsecurity.netapp.com/advisory/ntap-20230831-0004