The NocoDB application allows large characters to insert in the input field "New Project" on the create field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in nocodb/nocodb

Valid

Reported on

Jun 16th 2022


Proof of Concept

Go to http://localhost:8080/dashboard/#/projects Click on New project and create Fill the "Enter project name" field with huge characters, (more than 1 lakh) Copy the below payload and put it in the input fields and click on continue. You will see the application accepts large characters and if we will increase the characters then it can lead to Dos.

Download the payload from here:

https://drive.google.com/file/d/13IK67Sx93nvnb_3gLUBDLgoEC7XTQiso/view?usp=sharing

Video & Image POC:

https://drive.google.com/drive/folders/1N6h02blexPhQyj4MdfyPwNTOmKEXIfMu?usp=sharing

Patch recommendation:

The Project name input should be limited to 50 characters or a max of 100 characters.

Impact

It can lead to a denial of service attack

We are processing your report and will contact the nocodb team within 24 hours. a year ago
Arjun E modified the report
a year ago
We have contacted a member of the nocodb team and are waiting to hear back a year ago
nocodb/nocodb maintainer
a year ago

Maintainer


Handled in below PR image.

docker run -d -p 8888:8080 nocodb/nocodb-timely:0.91.10-pr-2416-20220617-1132

Expected to be available in the next release.

navi gave praise a year ago
Thank you for the report - we are looking debugging the issue
The researcher's credibility has slightly increased as a result of the maintainer's thanks: +1
We have sent a follow up to the nocodb team. We will try again in 7 days. a year ago
nocodb/nocodb maintainer has acknowledged this report a year ago
Arjun E
a year ago

Researcher


Any updates?

nocodb/nocodb maintainer validated this vulnerability a year ago
Arjun E has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
nocodb/nocodb maintainer marked this as fixed in 0.92.0 with commit 000ecd a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
Arjun E
a year ago

Researcher


@admin am I eligible to assign a CVE?

Jamie Slome
a year ago

Admin


We are happy to assign and publish a CVE if the maintainer is happy to do so as well.

@maintainer - are you happy with a CVE for this report?

Arjun E
a year ago

Researcher


@maintainer - Any updates from your side ?

աɨռɢӄաօռɢ
a year ago

Maintainer


The fix has been deployed. You may assign & publish a CVE.

Arjun E
a year ago

Researcher


@admin - maintainer is happy to assign the CVE, Please approve the CVE id @admin

Ben Harvie
a year ago

Admin


I have started the CVE assignment process and it should be published shortly. Happy hunting:)

to join this conversation