NocoDB Reflected Cross-Site Scripting Vulnerability in Password Reset Endpoint

A reflected cross-site scripting vulnerability has been identified in NocoDB versions prior to 0.258.0. The issue arises in the password reset API endpoint, specifically '/api/v1/db/auth/password/reset/:tokenId'. The vulnerability is caused by the use of an insecure function in the client-side template engine EJS, which allows for the injection of malicious scripts that are executed in the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the password reset endpoint with a tokenId that includes a script injection payload. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to NocoDB version 0.258.0 or later to address this vulnerability.