NocoDB Stored Cross-Site Scripting Vulnerability in Attachment Handling

A stored cross-site scripting vulnerability has been identified in NocoDB versions prior to 0.301.0. This issue arises from overly permissive MIME type checks and unsafe file serving practices, allowing authenticated users to upload malicious SVG files containing JavaScript. These files are executed in the browsers of users who view the attachment, potentially leading to account compromise, data exfiltration, and unauthorized actions on behalf of the affected users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files execute embedded JavaScript in the browsers of users who view the attachment. This can result in account takeover, theft of session cookies or API tokens, unauthorized actions performed on behalf of victims, and privilege escalation if higher-privileged users view the malicious attachment.

Remediation

Users can update to NocoDB version 0.301.0 or later to address this vulnerability.