Executive brief
NocoDB is an open-source database interface used to view and manage data through a web browser. An attacker can upload an HTML file containing malicious JavaScript code, and when a logged-in user previews that file, the scripts execute in their browser context. This could allow an attacker to steal session tokens, modify data, or perform actions on behalf of the user.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in NocoDB's file preview functionality. An authenticated attacker can upload an HTML file with embedded JavaScript to an attachment field. When a user accesses the uploaded file via its direct path in a browser, the JavaScript executes with the privileges of the logged-in user (CWE-434: unrestricted upload of dangerous file type; CWE-79: improper neutralization of input during web page generation). The attack requires low privileges (authenticated user) and user interaction (victim must click/preview the file). The vulnerability affects versions 0.202.6 through 0.202.9; it was patched in version 0.202.10.
Affected products
- NocoDB NocoDB 0.202.6 to 0.202.9
Timeline
- 2024-05-13: disclosed
- 2024-05-13: patched: Version 0.202.10 released with fix