CVE-2021-43787 XSS via prototype pollution
A prototype pollution flaw in NodeBB's uploader module allows attackers to inject JavaScript, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-43787?
CVE-2021-43787 is a critical cross-site scripting vulnerability in NodeBB, published on 29 Nov 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
Which versions are affected by CVE-2021-43787?
2 open source packages ship an affected version, including nodebb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nodebb npm | From 1.15.0 | 1.18.5 |
nodebb npm | From 1.15.0 | 1.18.5 |
Products include Nodebb Nodebb.
How do I fix CVE-2021-43787?
Upgrade nodebb to 1.18.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-43787 being exploited?
There is no known exploitation of CVE-2021-43787 in the wild and no public exploit code.
Other vulnerabilities in NodeBB
Sources
Also known as GHSA-wx69-rvg3-x7fc.