Executive brief
NocoDB, an open-source platform that turns databases into smart spreadsheets, is vulnerable to a security flaw that allows certain authorized users to run unauthorized database commands. An attacker with 'creator' level access could use this to bypass normal restrictions and view or modify sensitive information stored in the underlying database. This could lead to the exposure of private customer data or internal business records.
Technical details
A SQL injection vulnerability exists in NocoDB's SqliteClient.ts within the triggerList method. The root cause is the improper neutralization of the 'table_name' (tn) parameter, which is concatenated directly into a raw SQL query used to fetch trigger information from the sqlite_master table. An authenticated attacker with 'creator' access can provide a specially crafted payload to the tableCreate endpoint to perform blind, time-based SQL injection. This allows the attacker to exfiltrate data from the database by observing response time delays. The vulnerability is addressed in version 0.111.0.
Affected products
- nocodb nocodb < 0.111.0
Timeline
- 2023-10-17: disclosed
- 2023-10-17: advisory
- 2023-10-17: patched: Fixed in version 0.111.0
References
- https://github.com/nocodb/nocodb/security/advisories/GHSA-3m5q-q39v-xf8f
- https://github.com/nocodb/nocodb
- https://github.com/nocodb/nocodb/blob/3ec82824eeb2295f6b67fd67e7d6049784b41221/packages/nocodb/src/controllers/tables.controller.ts
- https://github.com/nocodb/nocodb/blob/3ec82824eeb2295f6b67fd67e7d6049784b41221/packages/nocodb/src/db/sql-client/lib/sqlite/SqliteClient.ts
- https://github.com/nocodb/nocodb/blob/3ec82824eeb2295f6b67fd67e7d6049784b41221/packages/nocodb/src/db/sql-client/lib/sqlite/SqliteClient.ts