Executive brief
NocoDB is an open-source Airtable alternative used to manage databases and collaborate on data. Sessions were not properly expiring after certain operations, allowing attackers with access to a browser after a user session ends to continue performing actions as that user until the browser session naturally expires. This could lead to unauthorized access to sensitive data and database modifications.
Technical details
NocoDB prior to version 0.91.9 suffered from insufficient session expiration (CWE-613) where user sessions were not properly invalidated after certain operations such as password changes. The vulnerability required prior authentication but could allow a threat actor with physical or adjacent access to an unlocked browser to continue performing API calls and database operations as the authenticated user. The fix (merged in PR #2338 and released in 0.91.9 on June 14, 2022) implements proper session termination, forcing users to re-authenticate after password changes and similar security-sensitive actions by dispatching a sign-out action and redirecting to the login page.
Affected products
- NocoDB NocoDB prior to 0.91.9
Timeline
- 2022-06-14: disclosed: Published in GitHub Advisory Database
- 2022-06-14: patched: Fixed in version 0.91.9
References
- https://github.com/nocodb/nocodb/pull/2262
- https://github.com/nocodb/nocodb/pull/2338
- https://github.com/nocodb/nocodb/commit/c9b5111b25aea2781e19395a8e9107ddbd235a2b
- https://github.com/nocodb/nocodb
- https://github.com/nocodb/nocodb/releases/tag/0.91.9
- https://huntr.dev/bounties/39523d51-fc5c-48b8-a082-171da79761bb