CVE-2023-35843

HIGHNuclei

nocodb nocodb Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-35843 has a selected CVSS score of 7.5 (high); EIP currently links 2 repository PoCs and 1 Nuclei template.

Description

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 18, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
2
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 11, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

nocodb

Browse nocodb / nocodb
VulnCheckVersion data not supplied

Proofs of concept

2

Repository PoCs

GitHubLserein/CVE-2023-35843Repository PoCby Lserein2Not analyzed4 files

170.5 KiB

GitHub
PoC details
GitHubb3nguang/CVE-2023-35843Repository PoCby b3nguang0Not analyzed2 files

1.7 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHNocoDB version <= 0.106.1 - Arbitrary File ReadCVSS 7.5

NocoDB through 0.106.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.

Impact

The vulnerability can lead to unauthorized access to sensitive information, potentially exposing user credentials, database contents, and other confidential data.

Remediation

Upgrade NocoDB to a version higher than 0.106.1 to mitigate the vulnerability.

WeaknessesCWE-22
Authorsdwisiswant0
Template tagscve2023cvenocodblfivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:-2017596142
FOFA: icon_hash=-2017596142
https://advisory.dw1.io/60 https://nvd.nist.gov/vuln/detail/CVE-2023-35843 https://github.com/nocodb/nocodb/blob/6decfa2b20c28db9946bddce0bcb1442b683ecae/packages/nocodb/src/lib/controllers/attachment.ctl.ts#L62-L74 https://github.com/nocodb/nocodb/blob/f7ee7e3beb91d313a159895d1edc1aba9d91b0bc/packages/nocodb/src/controllers/attachments.controller.ts#L55-L66 https://github.com/0x783kb/Security-operation-book

Source: ProjectDiscovery

References

4