Executive brief
NocoDB is a popular open-source database management and collaboration platform. An improper input validation vulnerability in table name handling could allow an attacker to cause a denial of service by crashing the application or corrupting data through malformed table name inputs.
Technical details
The vulnerability is an improper input validation issue (CWE-20) affecting NocoDB versions prior to 0.96.0, specifically in table name handling. The root cause involved missing or insufficient length validation on table names in the GUI. An unauthenticated attacker can trigger this via a network request by submitting excessively long or malformed table names, causing a denial of service condition. The fix was implemented in version 0.96.0 by adding a table name length validator in the GUI component (dlg/TableRename.vue).
Affected products
- NocoDB NocoDB prior to 0.96.0
Timeline
- 2023-09-21: disclosed
- 2023-09-21: patched: Fix released in version 0.96.0