NodeBB Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in NodeBB version 3.11.0. This vulnerability allows remote attackers to store arbitrary scripts in the 'about me' section of user profiles, which are executed when the profile is viewed by others.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the profile.

Reproduction

To reproduce this vulnerability, create a user account and navigate to the 'about me' section of the profile. Inject a script tag, such as one containing JavaScript code, into this section. Once the script is saved, log in as an administrator and access the 'Flagged Content' section in the admin tools. Click on the user who injected the script, and the stored script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can update to NodeBB version 3.11.1, where this vulnerability has been fixed.