Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04ZnhnLW1yMzQtanFyOM4AA74r

NocoDB SQL Injection vulnerability

Summary

---

An authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped table_name.

Details

---

SQL Injection vulnerability occurs in VitessClient.ts.

async columnList(args: any = {}) {
    const func = this.columnList.name;
    const result = new Result();
    log.api(`${func}:args:`, args);

    try {
      args.databaseName = this.connectionConfig.connection.database;

      const response = await this.sqlClient.raw(
        `select *, table_name as tn from information_schema.columns where table_name = '${args.tn}' ORDER by ordinal_position`,
      );

The variable ${args.tn} refers to the table name entered by the user.
A malicious attacker can escape the existing query by including a special character (') in the table name and insert and execute a new arbitrary SQL query.

Impact

---

This vulnerability may result in leakage of sensitive data in the database.

Permalink: https://github.com/advisories/GHSA-8fxg-mr34-jqr8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04ZnhnLW1yMzQtanFyOM4AA74r
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 7 months ago
Updated: 7 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-8fxg-mr34-jqr8, CVE-2023-50718
References:

• https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8
• https://nvd.nist.gov/vuln/detail/CVE-2023-50718
• https://github.com/advisories/GHSA-8fxg-mr34-jqr8

Repository: https://github.com/nocodb/nocodb
Blast Radius: 11.0

Affected Packages