Executive brief
NocoDB is an open-source database management and collaboration platform. An unauthenticated attacker can inject excessively large character strings into the "New Project" input field, causing the application to consume excessive resources and become unavailable to legitimate users.
Technical details
This is an uncontrolled resource consumption vulnerability (CWE-400, CWE-770) in NocoDB versions prior to 0.92.0. The flaw exists in the project creation input validation, which fails to limit the size of data accepted in the "New Project" field. An attacker can send a crafted HTTP request with an oversized payload to trigger a denial of service condition. The attack requires network accessibility to the NocoDB instance but does not require authentication. A fix is available in version 0.92.0 and later.
Affected products
- NocoDB NocoDB prior to 0.92.0
Timeline
- 2022-10-07: disclosed
- 2022-06-28: patched: Version 0.92.0 released
- 2022-10-07: advisory