CVE-2023-30591 NodeBB Pre-Authentication Denial-of-Service

What is CVE-2023-30591?

CVE-2023-30591 is a high-severity denial of service vulnerability in NodeBB, Inc. NodeBB, published on 29 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.

Weakness: CWE-754, CWE-241

Which versions are affected by CVE-2023-30591?

It affects 1 product.

Products include Nodebb Nodebb.

How do I fix CVE-2023-30591?

No fix has been published for CVE-2023-30591 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-30591 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-30591 exists.

Other vulnerabilities in NodeBB, Inc. NodeBB

• CVE-2023-26045 NodeBB vulnerable to path traversal and code execution via prototype vulnerability Critical 10.0
• CVE-2020-15149 Account takeover in NodeBB Critical 9.9
• CVE-2023-43187 Code injection in n/a Critical 9.8
• CVE-2021-43786 API token verification can be bypassed Critical 9.8
• CVE-2022-46164 Account takeover via prototype vulnerability Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mp98-q49w-jjhw.