Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-3c4m-j3g4-hh25
No affected components available
Summary
When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.
Affected package
flarum/nicknames— permissive display name driver that allows special characters; affected since initial release on the1.xbranch
Any third-party display name driver that permits special characters would be equally affected.
Variants
- Domain autolink — a nickname such as
nasty.comis automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird). - Markdown link syntax — a nickname such as
[CLICK](https://evil.com)is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird).
Steps to reproduce
Variant 1 (autolink — affects all email clients)
- Enable
flarum/nicknames, set nickname tonasty.com - Trigger a notification email to another user (e.g. follow them, mention them)
- The nickname appears as a clickable link in the received email
Variant 2 (markdown — affects markdown-rendering email clients)
- Enable
flarum/nicknames, set nickname to[CLICK](https://evil.com) - Trigger a notification email to another user
- In a markdown-rendering email client (e.g. Apple Mail), the nickname appears as a clickable link
Impact
Phishing / social engineering: victims may be misled into visiting attacker-controlled URLs via links appearing to originate from a trusted platform notification email. Variant 1 is exploitable against virtually all email clients without any special conditions.
- CVSS v3.1:
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N— 4.6 Medium
Root cause
The default username-based display name driver constrains values to [a-zA-Z0-9_-]+, making it immune. flarum/nicknames introduced permissive validation (min/max length and an optional admin-configured regex) that allows arbitrary characters including those meaningful in URL and markdown contexts. This has been the case since the first commit of the extension.
Proposed fix
- Add validation in
flarum/nicknamesto reject or sanitize nicknames containing characters that email clients may interpret as URLs or markdown links - Alternatively, sanitize the display name before insertion into notification email bodies so that legitimate nicknames like
Jane.Smithare preserved but rendered safely
References
- Bug bounty submission: SBB-L4ZVAFH8 (Intigriti)
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. The attacker needs the user to perform some action, like clicking a link. The impact is confined to the system where the vulnerability exists. There is a low impact on the confidentiality of the information. There is a low impact on the integrity of the data.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard