cve-2022-36076
Vulnerability from cvelistv5
Published
2022-09-02 12:30
Modified
2024-08-03 09:52
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.
References
security-advisories@github.comhttps://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/Exploit, Third Party Advisory
security-advisories@github.comhttps://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6Exploit, Patch, Third Party Advisory
Impacted products
Vendor Product Version
NodeBB NodeBB Version: < 1.17.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T09:52:00.513Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "NodeBB",
               vendor: "NodeBB",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.17.2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-352",
                     description: "CWE-352: Cross-Site Request Forgery (CSRF)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-09-02T12:30:14",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4",
            },
         ],
         source: {
            advisory: "GHSA-xmgg-fx9p-prq6",
            discovery: "UNKNOWN",
         },
         title: "Account takeover via SSO plugins in NodeBB",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2022-36076",
               STATE: "PUBLIC",
               TITLE: "Account takeover via SSO plugins in NodeBB",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "NodeBB",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.17.2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "NodeBB",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-352: Cross-Site Request Forgery (CSRF)",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/",
                     refsource: "MISC",
                     url: "https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/",
                  },
                  {
                     name: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6",
                     refsource: "CONFIRM",
                     url: "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6",
                  },
                  {
                     name: "https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4",
                     refsource: "MISC",
                     url: "https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4",
                  },
               ],
            },
            source: {
               advisory: "GHSA-xmgg-fx9p-prq6",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-36076",
      datePublished: "2022-09-02T12:30:14",
      dateReserved: "2022-07-15T00:00:00",
      dateUpdated: "2024-08-03T09:52:00.513Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2022-36076\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-09-02T13:15:08.847\",\"lastModified\":\"2024-11-21T07:12:19.727\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.\"},{\"lang\":\"es\",\"value\":\"El software de foros NodeBB funciona con Node.js y soporta Redis, MongoDB o una base de datos PostgreSQL. Debido a un condicional innecesariamente estricto en el código que maneja el primer paso del proceso de SSO, la lógica preexistente que agregaba (y luego verificaba) un nonce es convertido inadvertidamente en opt-in en lugar de opt-out. Esto Re expuso una vulnerabilidad en la que un ataque de tipo Man-in-the-Middle (MITM) especialmente diseñado podría teóricamente tomar el control de otra cuenta de usuario durante el proceso de inicio de sesión único. El problema ha sido completamente parcheado en la versión 1.17.2\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.17.2\",\"matchCriteriaId\":\"AEDC91B9-9893-4291-86CE-33A92DB28E54\"}]}]}],\"references\":[{\"url\":\"https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.