CVE-2023-50718

Executive Summary

CVE-2023-50718 is a SQL Injection vulnerability affecting NocoDB, an open-source database management tool that provides a spreadsheet-like interface for building databases. The flaw resides in the improper sanitization of the table_name parameter during table creation operations. An authenticated attacker with create access can inject arbitrary SQL commands into MySQL queries, potentially leading to the exfiltration of sensitive data from the underlying database. The vulnerability has a CVSS score of 6.5 (Medium) and is patched in version 0.202.10. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

NocoDB is distributed as a Docker image and via npm (@nocodb/nocodb). Users should verify the integrity of their installation by checking the official repository and Docker Hub for the patched version. The npm package should be updated to version 0.202.10 or later to mitigate this vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated user with create access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the requirement for authentication and the limitation to confidentiality impact. However, the low attack complexity and network-based vector make it a significant risk for environments where NocoDB is exposed to untrusted networks.

Deep Dive & Mechanics

The vulnerability exists in the API endpoint responsible for creating tables. When a user creates a new table, the table_name parameter is directly concatenated into SQL queries without proper escaping or parameterization. This allows an attacker to inject arbitrary SQL statements.

Root Cause: The application uses string concatenation to build SQL queries, specifically in the function that creates a new table. The table_name is not sanitized or escaped before being used in a CREATE TABLE statement.

Attack Vector: An authenticated attacker sends a crafted HTTP request to the table creation endpoint with a malicious table_name value. For example:

POST /api/v1/db/meta/tables
{
  "table_name": "`; SELECT * FROM information_schema.tables; --",
  ...
}

Impact: Successful exploitation allows the attacker to execute arbitrary SQL commands on the MySQL database, potentially reading sensitive data from other tables, including user credentials, application data, or system information.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.202.10):

// Example of vulnerable code pattern
const sql = `CREATE TABLE ${table_name} (id INT)`;
db.query(sql);

Patched Code (0.202.10):

// Example of patched code using parameterized queries
const sql = `CREATE TABLE ? (id INT)`;
db.query(sql, [table_name]);

The patched version uses parameterized queries or proper escaping functions to ensure that the table_name is treated as a literal value, not executable SQL.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a NocoDB instance (version < 0.202.10)
• Valid credentials with create table permissions

Exploitation Steps:

1. Authenticate to the NocoDB instance.
2. Send a crafted POST request to the table creation endpoint:

   POST /api/v1/db/meta/tables HTTP/1.1
   Host: target-nocodb.com
   Content-Type: application/json
   Authorization: Bearer <token>
   
   {
     "table_name": "`; SELECT * FROM information_schema.tables; --",
     "columns": [{"column_name": "id", "dt": "int"}]
   }
   

3. The injected SQL will be executed, and the results may be returned in the response or cause an error that leaks data.

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual table creation requests with special characters in the table_name field.
• Look for SQL error messages in application logs that contain injected SQL syntax.
• Use web application firewalls (WAF) to block requests containing SQL injection patterns.

Hunting:

• Search for HTTP requests to /api/v1/db/meta/tables with table_name containing backticks, semicolons, or SQL keywords.
• Review database logs for unexpected CREATE TABLE statements or queries that deviate from normal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/v1/db/meta/tables with table_name containing SQL metacharacters (e.g., ;, --, `)
  • Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax")

• Host IOCs:

  • Application logs showing SQL injection attempts
  • Database logs with unexpected CREATE TABLE or SELECT statements

• File IOCs:

  • NocoDB version file indicating version < 0.202.10

Detection Engineering

YARA Rule

rule CVE_2023_50718_NocoDB_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-50718 in NocoDB"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-50718"
    strings:
        $s1 = "/api/v1/db/meta/tables" ascii wide nocase
        $s2 = "table_name" ascii wide nocase
        $s3 = "`" ascii wide
        $s4 = ";" ascii wide
        $s5 = "--" ascii wide
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: NocoDB SQL Injection Attempt (CVE-2023-50718)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the table creation endpoint in NocoDB
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50718
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/db/meta/tables'
        cs-uri-query|contains: 
            - '`'
            - ';'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of special characters in table names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-50718 NocoDB SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/v1/db/meta/tables";
    http_uri;
    content:"table_name";
    http_client_body;
    pcre:"/(`|;|--)/Ri";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NocoDB to version 0.202.10 or later.
2. If immediate upgrade is not possible, restrict access to the table creation API endpoint to trusted users only.
3. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Long-term Mitigations:

• Enforce the principle of least privilege for database users.
• Regularly audit application logs for suspicious activity.
• Conduct code reviews to ensure all user inputs are properly sanitized or parameterized.
• Keep NocoDB and all dependencies up to date.

Workarounds:

• Disable the table creation feature for non-admin users if not required.
• Use a reverse proxy to filter and validate incoming requests.

Valters IT
DevSecOps & Cyber Threat Intelligence