Vulnerability Details : CVE-2023-35843
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.
Vulnerability category: Directory traversal
Products affected by CVE-2023-35843
- cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-35843
12.41%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-35843
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2023-35843
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-35843
-
https://github.com/nocodb/nocodb/blob/f7ee7e3beb91d313a159895d1edc1aba9d91b0bc/packages/nocodb/src/controllers/attachments.controller.ts#L55-L66
nocodb/packages/nocodb/src/controllers/attachments.controller.ts at f7ee7e3beb91d313a159895d1edc1aba9d91b0bc · nocodb/nocodb · GitHubProduct
-
https://advisory.dw1.io/60
CVE-2023-35843: Arbitrary File Read in NocoDB - dw1's AdvisoryExploit;Third Party Advisory
-
https://github.com/nocodb/nocodb/blob/6decfa2b20c28db9946bddce0bcb1442b683ecae/packages/nocodb/src/lib/controllers/attachment.ctl.ts#L62-L74
nocodb/packages/nocodb/src/lib/controllers/attachment.ctl.ts at 6decfa2b20c28db9946bddce0bcb1442b683ecae · nocodb/nocodb · GitHubProduct
Jump to