XSS via prototype pollution

Vulnerability

In NodeBB versions before 1.18.5, a prototype pollution vulnerability exists in the uploader module [1][2]. This bug allows a malicious user to inject arbitrary data (i.e., JavaScript) into the Document Object Model (DOM) of the forum application. The vulnerability is present in the upload functionality and requires no special privileges beyond being able to upload content. The attack surface is exposed to any authenticated forum user who can submit uploads.

Exploitation

An attacker must be an authenticated user of the NodeBB forum to exploit this vulnerability [1]. By crafting a malicious upload payload that pollutes the JavaScript prototype chain, the attacker can inject arbitrary JavaScript into the DOM. The injection occurs when the server processes the uploaded file and renders it in a way that interprets the polluted prototype. As the researcher notes, this can be combined with a path traversal vulnerability (CVE-2021-43788) to read arbitrary JSON files, potentially escalating to a full account takeover [1].

Impact

Successful exploitation allows the attacker to inject arbitrary JavaScript into the DOM, which can lead to Cross-Site Scripting (XSS) and, in conjunction with other vulnerabilities, account takeover [1]. The attacker could potentially steal session tokens, perform actions on behalf of the victim user, or read sensitive information from the page. The final impact described in the research is Remote Code Execution (RCE) on the NodeBB server, regardless of its configuration [1].

Mitigation

The vulnerability has been patched in NodeBB version 1.18.5, released on 2021-10-27 [2][3]. Users are strongly advised to upgrade to v1.18.5 or later as soon as possible. The fix includes disabling JavaScript in custom LESS tabs, which prevents the prototype pollution vector [3]. No workarounds are known for unpatched versions. If upgrading is not immediately possible, administrators should restrict upload permissions to trusted users only.