Description
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NodeBB | NodeBB | < 2.6.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
stephenbradshaw/CVE-2022-46164-poc ★ 12 · Jan 4, 2023
Basic POC exploit for CVE-2022-46164
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | nodebb | < 2.6.1 | 2.6.1 | GHSA-rf3g-v8p5-p675 |