Executive brief
NocoDB is an open-source database management and collaboration platform. The SMTP email plugin lacks validation on test requests, allowing attackers to send arbitrary requests to internal servers and read responses containing sensitive data, potentially exposing credentials, internal configuration, or other confidential information.
Technical details
The vulnerability is an unvalidated server-side request forgery (SSRF) combined with information disclosure (CWE-918, CWE-200, CWE-209) in NocoDB's SMTP plugin. The SMTP test API endpoint lacks verification of the target server, allowing unauthenticated network-accessible attackers to craft malicious SMTP test requests that reach internal servers. The attacker can then read response data, potentially extracting sensitive information such as internal IP addresses, hostnames, credentials, or service responses. The fix, applied in version 0.91.7, excludes sensitive server-related data from SMTP test API responses.
Affected products
- NocoDB NocoDB prior to 0.91.7
Timeline
- 2022-06-14: disclosed
- 2022-06-14: patched: Version 0.91.7 released with fix
- 2022-06-13: other: Published to NVD