CVE-2022-23602
📋 TL;DR
This vulnerability in Nimforum allows any authenticated user to create posts or threads that include local file references, which the server will render. This enables attackers to read sensitive files like forum.json containing secrets. All Nimforum instances running versions before 2.2.0 are affected.
💻 Affected Systems
- Nimforum
📦 What is this software?
Docutils by Nim Lang
Nimforum by Nim Lang
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Nimforum instance with theft of all secrets, potentially leading to privilege escalation, data exfiltration, or further system compromise if the forum runs with elevated privileges.
Likely Case
Theft of sensitive configuration files (forum.json) containing secrets, potentially allowing attackers to hijack user sessions, access databases, or compromise other integrated services.
If Mitigated
Limited to reading files accessible by the Nimforum process user, which could still expose sensitive configuration data but prevents system-wide compromise.
🎯 Exploit Status
Exploitation requires authenticated forum user access. The vulnerability is straightforward to exploit using the preview endpoint or regular post creation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.0
Vendor Advisory: https://github.com/nim-lang/nimforum/security/advisories/GHSA-q3vh-x957-wr75
Restart Required: Yes
Instructions:
1. Backup your current Nimforum installation and database. 2. Update Nimforum to version 2.2.0 or later using your package manager or by downloading from GitHub. 3. Restart the Nimforum service. 4. Verify the update was successful.
🧯 If You Can't Patch
- Restrict file system access for the Nimforum process user to minimal required directories.
- Implement strict input validation and filtering for post content at the web application firewall level.
🔍 How to Verify
Check if Vulnerable:
Check if your Nimforum version is below 2.2.0. The vulnerability exists in all versions prior to 2.2.0.Check Version:
Check the Nimforum version in the admin interface or by examining the installation directory.Verify Fix Applied:
Verify Nimforum version is 2.2.0 or higher. Test that local file inclusion attempts in posts/previews are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file path references in post creation logs
- Multiple failed file inclusion attempts
- Access to sensitive file paths in web server logs
Network Indicators:
- POST requests to preview endpoint with file:// or local path references
- Unusual patterns in post creation traffic
SIEM Query:
source="nimforum.log" AND ("file://" OR "/etc/" OR "/var/" OR "forum.json")🔗 References
- https://github.com/nim-lang/Nim/commit/cb894c7094fb49014f85815a9dafc38b5dda743e
- https://github.com/nim-lang/nimforum/security/advisories/GHSA-q3vh-x957-wr75
- https://github.com/nim-lang/Nim/commit/cb894c7094fb49014f85815a9dafc38b5dda743e
- https://github.com/nim-lang/nimforum/security/advisories/GHSA-q3vh-x957-wr75
