Executive brief
NocoDB is a popular open-source database management and collaboration platform. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts that execute in other users' browsers, potentially compromising accounts and enabling data theft or manipulation.
Technical details
This is a stored XSS vulnerability (CWE-79) in NocoDB prior to version 0.91.9. The vulnerability requires an authenticated user to inject malicious JavaScript code into the application, which is then persisted in the database. When other users view the affected content, the stored script executes in their browser context with the same permissions as the victim user. The attack requires login credentials and user interaction (viewing the affected page), but once successful, can lead to session hijacking, data exfiltration, or further lateral movement within the application.
Affected products
- NocoDB NocoDB prior to 0.91.9
Timeline
- 2022-06-14: disclosed: NVD published
- 2022-06-15: disclosed: GitHub Advisory published
- 2022-06-23: patched: Fix available in version 0.91.9