cve-2021-43786
Vulnerability from cvelistv5
Published
2021-11-29 19:30
Modified
2024-08-04 04:03
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.
References
security-advisories@github.comhttps://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
security-advisories@github.comhttps://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Release Notes, Third Party Advisory
security-advisories@github.comhttps://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqwThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqwThird Party Advisory
Impacted products
Vendor Product Version
NodeBB NodeBB Version: >= 1.15.0, < 1.18.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T04:03:08.931Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "NodeBB",
               vendor: "NodeBB",
               versions: [
                  {
                     status: "affected",
                     version: ">= 1.15.0, < 1.18.5",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-287",
                     description: "CWE-287: Improper Authentication",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-09-13T20:56:30",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/",
            },
         ],
         source: {
            advisory: "GHSA-hf2m-j98r-4fqw",
            discovery: "UNKNOWN",
         },
         title: "API token verification can be bypassed",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-43786",
               STATE: "PUBLIC",
               TITLE: "API token verification can be bypassed",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "NodeBB",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: ">= 1.15.0, < 1.18.5",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "NodeBB",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-287: Improper Authentication",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5",
                     refsource: "MISC",
                     url: "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5",
                  },
                  {
                     name: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw",
                     refsource: "CONFIRM",
                     url: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw",
                  },
                  {
                     name: "https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500",
                     refsource: "MISC",
                     url: "https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500",
                  },
                  {
                     name: "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/",
                     refsource: "MISC",
                     url: "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/",
                  },
               ],
            },
            source: {
               advisory: "GHSA-hf2m-j98r-4fqw",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-43786",
      datePublished: "2021-11-29T19:30:17",
      dateReserved: "2021-11-16T00:00:00",
      dateUpdated: "2024-08-04T04:03:08.931Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2021-43786\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-11-29T20:15:08.133\",\"lastModified\":\"2024-11-21T06:29:47.163\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.\"},{\"lang\":\"es\",\"value\":\"Nodebb es un software de foro de código abierto basado en Node.js. En las versiones afectadas, una lógica incorrecta presente en el paso de verificación del token permitía involuntariamente el acceso del token maestro a la API. La vulnerabilidad ha sido parcheada a partir de la versión v1.18.5. Se recomienda a usuarios que actualicen lo antes posible\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.15.0\",\"versionEndIncluding\":\"1.18.4\",\"matchCriteriaId\":\"688C48BA-FEEB-401F-B323-B2E5DCDE248F\"}]}]}],\"references\":[{\"url\":\"https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.