Aikido Finds Eight High-Severity Vulnerabilities in NodeBB
Summary
Aikido says a white-box assessment found eight high-severity flaws in NodeBB, including XSS, authorization bypasses, private-message exposure and post manipulation. The maintainers fixed the issues; users should upgrade to newer versions.
Key points
- Aikido reports finding eight high-severity vulnerabilities during a white-box assessment; it says the flaws were exploitable on default NodeBB instances.
- Three XSS flaws involved federated profile data, administrator federation-error logs and translation-template injection.
- A custom homepage rewrite could bypass an earlier admin authorization check, exposing the admin dashboard and some administrative data or functions.
- An ActivityPub GET request could spoof a user ID without verifying its signature, enabling access to private messages.
- Mass assignment of a post ID could overwrite an existing post; an unauthenticated category outbox could expose private posts.
- An unchecked actor in an ActivityPub Announce message could be used to inflate post upvotes.
- Aikido says it reported the findings to NodeBB maintainers, who fixed the issues; the article recommends upgrading to newer versions.
Article Details
- Attack Vectors
- Federated profile XSS: a custom ActivityPub server supplies an unescaped profile-icon URL that breaks out of a NodeBB meta tag and executes JavaScript when the profile is viewed.
- Federation Errors stored XSS: an unauthenticated sender submits a signed ActivityPub update with a malicious ID; the payload executes when an administrator views the error log.
- Translation-template injection: user-controlled input containing translation syntax can produce a javascript: link, including in reflected URLs, the admin quick-filter parameter, or stored posts; execution requires a click.
- Admin authorization bypass: a user sets a custom homepage route to /admin, and the rewrite occurs after the admin permission checks, exposing some admin pages and APIs.
- Private-message access through user-ID spoofing: an unverified Signature keyId on GET /message/:mid is used to set req.uid, allowing impersonation and access to private messages.
- Mass assignment of pid: a post-creation request supplies pid: 1 to overwrite the existing welcome post, then edits its content.
- Unauthenticated private-category disclosure: requesting /category/{cid}/outbox with an ActivityPub Accept header returns category posts without checking read permissions.
- Upvote manipulation: an Announce message embeds a Like with an unchecked actor, allowing repeated requests to inflate a post's upvote count.
- Defensive Notes
- Upgrade NodeBB to version 4.14.0 or newer; the article states that versions before 4.14.0 contain multiple high-severity vulnerabilities.
- Escape data from federated sources and escape all fields rendered in Federation Errors.
- Refactor translation handling to auto-escape translated output and sanitize translator-generated HTML, including javascript: links.
- Run admin permission checks after custom homepage rewriting.
- Set req.uid from a Signature keyId only after the signature has been verified.
- Remove pid from user-supplied post-creation data so it cannot overwrite internal post identifiers.
- Check topics:read permission on the category outbox route.
- Verify the Signature header for POST requests, including Announce messages.
MITRE ATT&CK
T1059.007 · JavaScriptThe XSS proof of concepts execute JavaScript in a victim's browser through injected HTML and a javascript: link.T1190 · Exploit Public-Facing ApplicationThe article demonstrates exploitation of multiple NodeBB web-application vulnerabilities, including authorization bypasses and data disclosure.T1213 · Data from Information RepositoriesThe demonstrated authorization flaws expose private messages and posts from private categories.T1565.001 · Stored Data ManipulationA crafted post-creation request overwrites the existing post with pid 1, enabling subsequent modification of its content; the article also demonstrates repeated upvote manipulation.