Reflected XSS on 404 Page Not found

[HenryHoggard]

There is a reflected XSS vulnerability when putting Javascript in the following NodeBB URL.
http://forum.tld/user/1<script>alert(1)</script>

[julianlam]

https://community.nodebb.org/user/1%3Cscript%3Ealert(1)%3C/script%3E

Seems to not be an issue on master. What version of NodeBB are you running?

[dmyates]

Okay, so in many cases just clicking on the link doesn't give you XSS, because your browser automatically URL encodes the angle brackets. But if you click on the link, intercept your request (use Burp Suite or Fiddler or similar) and URL decode the path, it works.

Depending on your deployment of NodeBB's surrounding infrastructure, this decoding may be done at some point before the request hits NodeBB. In those cases this would certainly be an XSS vector.