Executive Summary
This security assessment was conducted using Kolega.dev's automated security remediation platform, which combines traditional security scanning (SAST, SCA, secrets detection) with proprietary AI-powered deep code analysis. Our two-tier detection approach identified vulnerabilities that standard tools miss, including complex logic flaws and cross-service injection vectors.
Our analysis of the NocoDB repository identified 5 vulnerabilities through Kolega.dev Deep Code Scan (Tier 2) and 14 findings through traditional SAST scanning (Tier 1) that warrant attention. Following responsible disclosure practices and after the SLA period expired without response, verified fixes for all critical and high severity vulnerabilities have been submitted as public pull requests. Fixes have been implemented by NocoDB on their own internal private branches.
Vulnerability Overview
| ID | Title | Severity | Exploitable | Requires |
|---|---|---|---|---|
| V1 | SQL Injection in Oracle Client | Critical | Yes | Org Creator+ role |
| V2 | WebSocket Authentication Bypass | Low (OSS) / High (Enterprise) | Yes | None |
| V3 | SSRF in Attachment Upload | High | Yes | Editor+ role |
| V4 | SSRF in uploadViaURL | High | Yes | Upload permission |
| V5 | Information Disclosure in Errors | Medium | Yes | Editor+ role |
Responsible Disclosure Timeline
Submitted Pull Requests - Deep Scan Vulnerabilities (Tier 2)
| Vuln ID | PR # | Title | Link |
|---|---|---|---|
| V1 | #12748 | fix(security): V1 - resolve SQL injection vulnerabilities in Oracle client SQL Injection in Oracle Client | View PR |
| V2 | #12749 | fix(security): V2 - properly validate WebSocket authentication in gateway middleware WebSocket Authentication Bypass | View PR |
| V3 | #12750 | fix(security): V3 - add SSRF protection to attachment URL upload SSRF in Attachment Upload | View PR |
| V4 | #12751 | fix(security): V4 - apply SSRF protection to axios.head() in uploadViaURL SSRF in uploadViaURL | View PR |
| V5 | #12752 | fix(security): V5 - sanitize error messages in base64 attachment processing Information Disclosure in Errors | View PR |
Critical Vulnerabilities Overview
Description
The Oracle database client concatenates user-controlled parameters directly into SQL queries without parameterization. This affects multiple operations including user existence checks, table enumeration, and schema introspection.
Impact
- •Execute arbitrary SQL commands on Oracle databases
- •Exfiltrate sensitive data
- •Escalate to DBA privileges
- •Achieve complete database compromise
Remediation
Replace string concatenation with parameterized queries using Oracle bind variables. Apply this pattern to all 17 affected lines using Knex built-in parameterization where available.
Description
The WebSocket authentication middleware silently catches all errors and unconditionally allows connections, regardless of authentication status.
Impact
- •OSS: WebSocket only handles telemetry events, can pollute analytics data
- •EE: Real-time data sync implemented, attackers receive database updates
- •Session hijacking and data exfiltration possible in Enterprise
- •Allows connections with missing, invalid, or expired tokens
Remediation
Properly validate authentication status and reject unauthorized connections with proper error propagation
Description
The downloadAndStoreAttachment function accepts user-supplied URLs without SSRF protection, allowing authenticated users to make arbitrary HTTP requests from the server.
Impact
- •Access cloud metadata endpoints (AWS/GCP/Azure credentials)
- •Scan internal network services
- •Reach internal APIs and databases
- •Potentially chain to RCE via vulnerable internal services
Remediation
Add request-filtering-agent protection using existing project dependency with httpAgent and httpsAgent configuration
Description
The axios.head() call in uploadViaURL() lacks SSRF protection. While the subsequent fileCreateByUrl() has protection, the initial HEAD request executes without validation.
Impact
- •Blind SSRF via HEAD requests
- •Cloud credential theft from metadata endpoints
- •Internal network reconnaissance
Remediation
Apply consistent SSRF protection to HEAD request using request-filtering-agent
Description
Raw error objects are interpolated directly into API responses, exposing internal system information including absolute server paths, system usernames, operating system details, and internal ID structures.
Impact
- •Exposes absolute server paths
- •Reveals system usernames
- •Discloses operating system details
- •Shows internal ID structures
- •Leaks file system structure and upload paths
Remediation
Return generic error messages to client while logging detailed errors server-side
Traditional Scan Findings Summary (Tier 1)
| Rule | Name | Findings | Severity | PR Link |
|---|---|---|---|---|
| #6 | missing-user-entrypoint | 1 | High | Pull Request |
| #7 | missing-user | 1 | High | Pull Request |
| #12 | avoid-v-html | 10 | Medium | Pull Request |
| #19 | wildcard-postmessage-configuration | 1 | Medium | Pull Request |
| #20 | insufficient-postmessage-origin-validation | 1 | Medium | Pull Request |