NocoDB User Enumeration Vulnerability via Password Reset Endpoint

A user enumeration vulnerability has been identified in NocoDB versions prior to 0.301.3. The issue arises in the password reset endpoint, which responds differently for registered and unregistered email addresses. This discrepancy allows an attacker to determine the registration status of an email. The vulnerability has been patched in version 0.301.3.

Impact

Exploitation of this vulnerability allows an unauthenticated attacker to ascertain whether an email address is registered in the system, potentially aiding in further targeted attacks.

Reproduction

To reproduce this vulnerability, send a POST request to the password forgot endpoint with either a registered or unregistered email address. The response will indicate whether the email is registered, thereby allowing for user enumeration.

Remediation

Users can upgrade to NocoDB version 0.301.3 to address this vulnerability.