github - ghsa-qg73-g3cf-vhhh

GHSA-QG73-G3CF-VHHH

Vulnerability from github – Published: 2024-05-13 16:46 – Updated: 2025-08-21 19:16

Summary

NocoDB Allows Preview of Files with Dangerous Content

Details

Summary

Attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading Stored XSS(Cross-Site Script) attack.

PoC

NocoDB was configured using the Release Binary Noco-macos-arm64, and nocodb version 0.202.9 (currently the latest version) was used. binary hash infos: md5(164b727f287af56168bc16fba622d0b4) / sha256(43e8e97f4c5f5330613abe071a359f84e4514b7186f92954b678087c37b7832e)

1. Run the binary to start the server and access the arbitrary table dashboard.

Here, used the default Features table.

2. Click `+` in the table `field header` to add an `attachment` field.

3. Click the `Add File(s)` button to select and upload files.

Here, test.html containing <script>alert(document.domain)</script> was uploaded.

4. Check the uploaded file path.

<img width="1163" alt="image" src="https://user-images.githubusercontent.com/86613161/287473337-b1c7c781-2fb5-4bd0-b464-dbd3d4158f04.png"

5. Access the uploaded file path.

When the file path is accessed, the <script>alert(document.domain)</script> script statement contained in the file is executed and the server host appears in the alert message.

Impact

This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form.

Severity ?

5.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.202.9"
      },
      "package": {
        "ecosystem": "npm",
        "name": "nocodb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.202.6"
            },
            {
              "fixed": "0.202.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-50717"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-13T16:46:49Z",
    "nvd_published_at": "2024-05-14T14:17:01Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n---\nAttacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading  Stored XSS(Cross-Site Script) attack.\n\n### PoC\n---\nNocoDB was configured using the Release Binary `Noco-macos-arm64`, and nocodb version 0.202.9 (currently the latest version) was used.\nbinary hash infos: md5(164b727f287af56168bc16fba622d0b4) / sha256(43e8e97f4c5f5330613abe071a359f84e4514b7186f92954b678087c37b7832e)\n\u003cimg width=\"665\" alt=\"image\" src=\"https://user-images.githubusercontent.com/86613161/287472673-aeb60a02-2080-429f-8583-9f130ab62779.png\"\u003e\n\n### 1. Run the binary to start the server and access the arbitrary table dashboard.\n\u003cimg width=\"830\" alt=\"image\" src=\"https://user-images.githubusercontent.com/86613161/287472852-98b2286e-ad66-45bf-b503-63780619d775.png\"\u003e\n\nHere, used the default `Features` table.\n\n### 2. Click `+` in the table `field header` to add an `attachment` field.\n\u003cimg width=\"1173\" alt=\"image\" src=\"https://user-images.githubusercontent.com/86613161/287472936-98a67213-a547-4e71-915c-d2a43300530b.png\"\u003e\n\n### 3. Click the `Add File(s)` button to select and upload files.\n\n\u003cimg width=\"1132\" alt=\"image\" src=\"https://user-images.githubusercontent.com/86613161/287473041-0801ff39-e48c-4746-8518-be825bfd5533.png\"\u003e\n\nHere, `test.html` containing `\u003cscript\u003ealert(document.domain)\u003c/script\u003e` was uploaded.\n\n### 4. Check the uploaded file path.\n\u003cimg width=\"1163\" alt=\"image\" src=\"https://user-images.githubusercontent.com/86613161/287473337-b1c7c781-2fb5-4bd0-b464-dbd3d4158f04.png\"\n\n### 5. Access the uploaded file path.\n\u003cimg width=\"1201\" alt=\"image\" src=\"https://user-images.githubusercontent.com/86613161/287473278-410f9228-58e3-4ee4-b111-70cdbffa9ed5.png\"\u003e\n\nWhen the file path is accessed, the `\u003cscript\u003ealert(document.domain)\u003c/script\u003e` script statement contained in the file is executed and the server host appears in the alert message.\n\n\n### Impact\n---\nThis allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form.",
  "id": "GHSA-qg73-g3cf-vhhh",
  "modified": "2025-08-21T19:16:05Z",
  "published": "2024-05-13T16:46:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50717"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nocodb/nocodb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "NocoDB Allows Preview of Files with Dangerous Content"
}

CVE-2023-50717 (GCVE-0-2023-50717)

Vulnerability from cvelistv5 – Published: 2024-05-13 16:05 – Updated: 2024-08-02 22:16

Title

NocoDB Allows Preview of File with Dangerous Content

Summary

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue.

Severity ?

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

https://github.com/nocodb/nocodb/security/advisor…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	nocodb	nocodb	Affected: >= 0.202.6, < 0.202.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nocodb",
            "vendor": "nocodb",
            "versions": [
              {
                "lessThanOrEqual": "0.202.6",
                "status": "affected",
                "version": "0.202.6*",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nocodb",
            "vendor": "nocodb",
            "versions": [
              {
                "lessThan": "0.202.10",
                "status": "affected",
                "version": "0.202.10*",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-50717",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-13T17:13:25.707918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:17:55.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:47.335Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nocodb",
          "vendor": "nocodb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.202.6, \u003c 0.202.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading  stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-13T16:05:48.148Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh"
        }
      ],
      "source": {
        "advisory": "GHSA-qg73-g3cf-vhhh",
        "discovery": "UNKNOWN"
      },
      "title": "NocoDB Allows Preview of File with Dangerous Content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-50717",
    "datePublished": "2024-05-13T16:05:48.148Z",
    "dateReserved": "2023-12-11T17:53:36.030Z",
    "dateUpdated": "2024-08-02T22:16:47.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-QG73-G3CF-VHHH

Summary

PoC

1. Run the binary to start the server and access the arbitrary table dashboard.

2. Click + in the table field header to add an attachment field.

3. Click the Add File(s) button to select and upload files.

4. Check the uploaded file path.

5. Access the uploaded file path.

Impact

CVE-2023-50717 (GCVE-0-2023-50717)

Tags

Sightings

Nomenclature

2. Click `+` in the table `field header` to add an `attachment` field.

3. Click the `Add File(s)` button to select and upload files.