CVE-2022-36076 Account takeover via SSO plugins in NodeBB

What is CVE-2022-36076?

CVE-2022-36076 is a high-severity vulnerability in NodeBB, published on 2 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.

Weakness: CWE-352

Which versions are affected by CVE-2022-36076?

2 open source packages ship an affected version, including nodebb. It affects 1 product.

Products include Nodebb Nodebb.

How do I fix CVE-2022-36076?

Upgrade nodebb to 1.17.2 or later.

Is CVE-2022-36076 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36076 exists.

Other vulnerabilities in NodeBB

• CVE-2023-26045 NodeBB vulnerable to path traversal and code execution via prototype vulnerability Critical 10.0
• CVE-2020-15149 Account takeover in NodeBB Critical 9.9
• CVE-2023-43187 Code injection in n/a Critical 9.8
• CVE-2021-43786 API token verification can be bypassed Critical 9.8
• CVE-2022-46164 Account takeover via prototype vulnerability Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xmgg-fx9p-prq6.