CVE-2022-46164 Account takeover via prototype vulnerability

What is CVE-2022-46164?

CVE-2022-46164 is a critical authentication bypass vulnerability in NodeBB, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

Weakness: CWE-665

Which versions are affected by CVE-2022-46164?

2 open source packages ship an affected version, including nodebb. It affects 1 product.

Products include Nodebb Nodebb.

How do I fix CVE-2022-46164?

Upgrade nodebb to 2.6.1 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-46164 being exploited?

There is no known exploitation of CVE-2022-46164 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in NodeBB

• CVE-2023-26045 NodeBB vulnerable to path traversal and code execution via prototype vulnerability Critical 10.0
• CVE-2020-15149 Account takeover in NodeBB Critical 9.9
• CVE-2023-43187 Code injection in n/a Critical 9.8
• CVE-2021-43786 API token verification can be bypassed Critical 9.8
• CVE-2022-36045 Account takeover via cryptographically weak PRNG in NodeBB Forum Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rf3g-v8p5-p675.