GitHub Advisoryadvisory · npm
GHSA-hf2m-j98r-4fqw API token verification can be bypassed in NodeBB
CRITICAL
Official page ↗
- Aliases
- CVE-2021-43786
- Ecosystem
- npm
- Packages
- nodebb
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-287
- Reviewed
- 2021-11-30
Affected packages
• npm nodebb: >= 1.15.0, < 1.18.5 → fixed in 1.18.5
Description
Impact
Incorrect logic present in the token verification step unintentionally allowed master token access to the API.
Patches
The vulnerability has been patch as of v1.18.5.
Workarounds
Cherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.
For more information
If you have any questions or comments about this advisory:
• Email us at [email protected]
Related
Alias · CVE (1)
- CVE-2021-43786 Nodebb is an open source Node.js based forum software. vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw web
- https://nvd.nist.gov/vuln/detail/CVE-2021-43786 advisory
- https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500 web
- https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot web
- https://github.com/NodeBB/NodeBB package
- https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5 web