Broken Access Control on NodeBB v3.6.7

vendor:

NodeBB

by:

Vibhor Sharma

6.1

CVSS

HIGH

Broken Access Control

285

CWE

Product Name: NodeBB

Affected Version From: 3.6.2007

Affected Version To: 3.6.2007

Patch Exists: YES

Related CWE:

CPE: nodebb:nodebb:3.6.7

Metasploit:

Other Scripts:

Platforms Tested:

2024

Broken Access Control on NodeBB v3.6.7

A broken access control vulnerability was found in NodeBB v3.6.7, allowing unauthorized users to access restricted information meant for administrators only. By manipulating certain attributes in the JSON response after intercepting the group request, users with minimal privileges can access tabs limited to administrators. This issue was acknowledged and fixed by the developers upon discovery.

Mitigation:

To mitigate this vulnerability, users should update to the latest version of NodeBB to ensure the fix is applied.

Source

Exploit-DB raw data:

Exploit Title: Broken Access Control - on NodeBB v3.6.7

Date: 22/2/2024

Exploit Author: Vibhor Sharma

Vendor Homepage: https://nodebb.org/

Version: 3.6.7

Description:

I identified a broken access control vulnerability in nodeBB v3.6.7,
enabling attackers to access restricted information intended solely
for administrators. Specifically, this data is accessible only to
admins and not regular users. Through testing, I discovered that when
a user accesses the group section of the application and intercepts
the response for the corresponding request, certain attributes are
provided in the JSON response. By manipulating these attributes, a
user can gain access to tabs restricted to administrators. Upon
reporting this issue, it was duly acknowledged and promptly resolved
by the developers.



Steps To Reproduce:
1) User with the least previlages needs to neviagte to the group section.
2) Intercept the response for the group requets.
3) In the response modify the certian paramters : "
*"system":0,"private":0,"isMember":true,"isPending":true,"isInvited":true,"isOwner":true,"isAdmin":true,
**" *".
4) Forward the request and we can see that attacker can access the
restricted information.

*Impact:*
Attacker was able to access the restricted tabs for the Admin group
which are only allowed the the administrators.