CVE-2023-49781 NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

What is CVE-2023-49781?

CVE-2023-49781 is a high-severity cross-site scripting vulnerability in nocodb, published on 13 May 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag <a> with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.

Weakness: CWE-79

Which versions are affected by CVE-2023-49781?

2 open source packages ship an affected version, including nocodb. It affects 1 product.

Products include Nocodb Nocodb.

How do I fix CVE-2023-49781?

Upgrade nocodb to 0.202.9 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-49781 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49781 exists.

Other vulnerabilities in nocodb

• CVE-2022-2339 Server-Side Request Forgery (SSRF) in nocodb/nocodb Critical 9.1
• CVE-2022-2062 Generation of Error Message Containing Sensitive Information in nocodb/nocodb Critical 9.1
• CVE-2022-2064 Insufficient Session Expiration in nocodb/nocodb Critical 9.1
• CVE-2022-2063 Improper Privilege Management in nocodb/nocodb Critical 9.0
• CVE-2022-2022 Cross-site Scripting (XSS) - Stored in nocodb/nocodb Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h6r4-xvw6-jc5h.