cbcvebase.
CVE-2020-15149
published 2020-08-20

CVE-2020-15149: NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a…

PriorityP267critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAL
EXPLOIT
EPSS
2.43%
82.2th percentile
NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.

Affected

2 ranges
VendorProductVersion rangeFixed in
nodebbnodebb——
nodebbnodebb>= 1.12.2 < 1.14.31.14.3

Detection & IOCsextracted from sources · hover to see the quote

command42["user.changePassword",("currentPassword":"Test.12345!","newPassword":"Admin123!","uid":5)]↗
hash16cee1b03ba3eee177834a1fdac4aa8a12b39d2a↗
  • →Monitor for socket.io frames containing the 'user.changePassword' event where the 'uid' field in the payload does not match the authenticated session's own user ID — this is the core indicator of the privilege-escalation attempt. ↗
  • →Alert on any 'user.changePassword' socket.io call where uid=1 (admin) is supplied by a non-admin authenticated session, as the PoC explicitly targets uid 1. ↗
  • →Inspect NodeBB server logs for password-change events on high-privilege accounts (uid=1) originating from low-privilege user sessions — cross-reference session uid vs. target uid in changePassword calls. ↗
  • ·Vulnerability is version-bounded: only NodeBB instances running versions 1.12.2 through 1.14.2 are affected. Versions prior to 1.12.2 and 1.14.3+ are not vulnerable. ↗
  • ·The flaw is in the server-side validation logic for the changePassword socket.io handler — the server fails to verify that the requesting user's session uid matches the target uid in the payload, allowing arbitrary uid substitution. ↗

CVSS provenance

nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.