SQL Injection Affecting nocodb package, versions <0.111.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NOCODB-6003646
- published 22 Oct 2023
- disclosed 17 Oct 2023
- credit Sylwia Budzynska
Introduced: 17 Oct 2023
CVE-2023-43794 Open this link in a new tabHow to fix?
Upgrade nocodb to version 0.111.0 or higher.
Overview
nocodb is a NocoDB
Affected versions of this package are vulnerable to SQL Injection via the triggerList function in SqliteClient.ts. An attacker can inject arbitrary SQL queries to be executed by supplying a specially crafted payload to the table_name parameter in the tableCreate endpoint. The attacker can reveal the data present in the database by using time-based payloads which would include a function to delay execution for a given number of seconds. The response time indicates whether the result of the query execution was true or false.
Note:
This is only exploitable if the attacker has creator permissions.