# NodeBB 1.18.4 - Remote Code Execution With One Shot

Three NodeBB flaws chain: path traversal reads JSON config, wormable XSS via translation tags, and prototype-key auth bypass granting master API tokens and RCE.

- Payout: $1,536
- Severity: critical
- Program: NodeBB
- Credited: Sonar
- Disclosed: 2021-11-30
- CVE: CVE-2021-43786, CVE-2021-43787, CVE-2021-43788
- Write-up quality: 8/10
- Original: https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-sonarsource-com-nodebb-remote-code-execution-with-one-shot
- Tags: domain:web impact:ato impact:rce kind:bounty platform:blog sev:critical tech:nodejs technique:chained technique:source-review vuln:auth-bypass vuln:path-traversal vuln:prototype-pollution vuln:xss

**Target:** NodeBB forum web UI and REST API (template engine, i18n, token auth)
**Root cause:** Translation namespace used unsanitized in path.join (traversal); translation tags resolved after HTML sanitization; token lookup on object literal inherits Object.prototype keys like toString/constructor, parsed to NaN and treated as master token.
**Steps:**
1. Path traversal: request URL path/query reflected into og:url meta tag; include `[[../../../../path/to/file:key]]` translation tag to read any .json file (e.g. config with session secret).
2. XSS: create account, put JS payload in profile field, export profile to `build/export/UID_profile.json`, then set profile field to a translation tag pointing at that file via traversal; payload executes on profile/post views and self-propagates.
3. Auth bypass: send `Authorization: Bearer toString` (or `constructor`) to any API endpoint; lookup hits inherited Object.prototype property, parseInt yields NaN, master=true.
4. Use master token with `?_uid=1` (admin) to call admin API and achieve RCE in a single request.
**How found:** Code review of i18n path construction (no containment check), of meta tag rendering (brackets not escaped, sanitization before translation), and of token verification building an object literal and using `in`-style lookup on inherited prototype keys.
**Exploitation:** Unauthenticated attacker sends a single API request with Bearer token `toString`/`constructor`, gets master auth, sets `_uid=1` to act as admin, then uses admin API to execute code on the server. Separately, traversal + exported-profile JSON enables wormable XSS reaching admin accounts.
**Escalation:** Chained file read (session secret) and wormable XSS to admin takeover; auth bypass to master token to admin API to RCE.
**Insight:** Object-literal maps used for token/secret lookup inherit Object.prototype keys (toString, constructor, __proto__); if the value is parseInt'd and compared >0, inherited function values become NaN and can be misclassified as privileged. Also: sanitize after template/translation resolution, not before.