CVE-2022-36045 (published 2022-08-31T15:15Z)

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to. This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the patch sets listed above will fully patch the vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-338
cwe_name: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
extended_description: 
            When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks.
            Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.
         
         

Fix information:
repo_url: https://github.com/NodeBB/NodeBB
commit_details: repo_url: https://github.com/NodeBB/NodeBB
author: Barış Soner Uşaklı
author_date: 2022-05-26 12:12:19-04:00
msg: fix: get rid of math.random in utils.generateUUID
repository: repo_url: https://github.com/NodeBB/NodeBB
repo_name: NodeBB/NodeBB
description: Node.js based forum software built for the modern web
repo_language: JavaScript
owner: NodeBB
file_changes: filename: utils.common.js
change_type: ModificationType.MODIFY
diff: @@ -274,15 +274,6 @@ const HTMLEntities = Object.freeze({
 
 /* eslint-disable no-redeclare */
 const utils = {
-	generateUUID: function () {
-		/* eslint-disable no-bitwise */
-		return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {
-			const r = Math.random() * 16 | 0;
-			const v = c === 'x' ? r : ((r & 0x3) | 0x8);
-			return v.toString(16);
-		});
-		/* eslint-enable no-bitwise */
-	},
 	// https://github.com/substack/node-ent/blob/master/index.js
 	decodeHTMLEntities: function (html) {
 		return String(html)

programming_language: JavaScript
filename: utils.js
change_type: ModificationType.MODIFY
diff: @@ -73,4 +73,12 @@ utils.assertPasswordValidity = (password) => {
 	}
 };
 
+utils.generateUUID = function () {
+	// from https://github.com/tracker1/node-uuid4/blob/master/browser.js
+	const temp_url = URL.createObjectURL(new Blob());
+	const uuid = temp_url.toString();
+	URL.revokeObjectURL(temp_url);
+	return uuid.split(/[:\/]/g).pop().toLowerCase(); // remove prefixes
+};
+
 module.exports = utils;

programming_language: JavaScript
filename: utils.js
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,7 @@
 'use strict';
 
+const crypto = require('crypto');
+
 process.profile = function (operation, start) {
 	console.log('%s took %d milliseconds', operation, process.elapsedTimeSince(start));
 };
@@ -14,4 +16,17 @@ utils.getLanguage = function () {
 	const meta = require('./meta');
 	return meta.config && meta.config.defaultLang ? meta.config.defaultLang : 'en-GB';
 };
+
+utils.generateUUID = function () {
+	// from https://github.com/tracker1/node-uuid4/blob/master/index.js
+	let rnd = crypto.randomBytes(16);
+	/* eslint-disable no-bitwise */
+	rnd[6] = (rnd[6] & 0x0f) | 0x40;
+	rnd[8] = (rnd[8] & 0x3f) | 0x80;
+	/* eslint-enable no-bitwise */
+	rnd = rnd.toString('hex').match(/(.{8})(.{4})(.{4})(.{4})(.{12})/);
+	rnd.shift();
+	return rnd.join('-');
+};
+
 module.exports = utils;

programming_language: JavaScript