Executive brief
NocoDB is a popular open-source database management and collaboration tool. The application contains a blind Server-Side Request Forgery (SSRF) vulnerability in its file upload feature that allows authenticated users to trigger unfiltered HTTP HEAD requests to internal or external servers before security checks are applied. While the actual file download is protected, this blind SSRF could enable attackers to probe internal network services or trigger interactions with sensitive internal endpoints.
Technical details
A blind SSRF vulnerability exists in the uploadViaURL() function, which uses axios.head() to retrieve metadata (content-type, content-length, redirect URL) without SSRF validation. Although the subsequent file download logic enforces proper SSRF protections, the initial HEAD request is executed before these controls are applied, allowing an attacker to send arbitrary unfiltered HEAD requests to attacker-controlled URLs. The vulnerability requires low-privilege authentication (xc-auth token) and a high attack complexity due to constraints (HEAD-only, no response body exfiltration). An attacker can perform blind outbound requests for internal service probing or interaction with sensitive endpoints, though direct data exfiltration is not possible. Patches are available in version 0.301.0 and later.
Affected products
- NocoDB NocoDB <=0.265.1
Timeline
- 2026-01-28: disclosed
- 2026-01-28: patched: Fixed in version 0.301.0