CVE-2023-50718: NocoDB SQL Injection vulnerability
Summary --- An authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped tablename.
Details --- SQL Injection vulnerability occurs in VitessClient.ts. javascript async columnList(args: any = {}) { const func = this.columnList.name; const result = new Result(); log.api(${func}:args:, args);
try { args.databaseName = this.connectionConfig.connection.database;
const response = await this.sqlClient.raw( select , tablename as tn from informationschema.columns where tablename = '${args.tn}' ORDER by ordinalposition, ); The variable ${args.tn} refers to the table name entered by the user. A malicious attacker can escape the existing query by including a special character (') in the table name and insert and execute a new arbitrary SQL query.
Impact --- This vulnerability may result in leakage of sensitive data in the database.
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped tablename. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50718?
CVE-2023-50718 is classified as a high severity vulnerability due to its potential for SQL Injection attacks.
How do I fix CVE-2023-50718?
To mitigate CVE-2023-50718, update the nocodb software to version 0.202.10 or later.
Who is affected by CVE-2023-50718?
CVE-2023-50718 affects users of nocodb versions up to and including 0.202.9 that have create access.
What kind of attack can be executed using CVE-2023-50718?
CVE-2023-50718 allows authenticated attackers to perform SQL Injection attacks on MySQL databases.
In which file does the vulnerability CVE-2023-50718 occur?
CVE-2023-50718 occurs in the VitessClient.ts file.