Cross-site Scripting (XSS) - Stored in nocodb/nocodb

The impact of this XSS vulnerability is significant. An attacker could inject malicious JavaScript code that executes in the context of other users' browsers. This could be used to steal session cookies, redirect users to phishing sites, or deface the application. Successful exploitation could grant an attacker full control over user accounts and potentially the entire NocoDB instance, depending on the permissions configured. The stored nature of the XSS means the injected script persists until removed, allowing for repeated exploitation without further attacker action. This is particularly concerning in environments where NocoDB is used to manage sensitive data.

Organizations using NocoDB to manage sensitive data, particularly those with publicly accessible instances or those who allow user-generated content within NocoDB, are at significant risk. Shared hosting environments where multiple NocoDB instances reside on the same server are also vulnerable, as a compromise of one instance could potentially lead to lateral movement to others.

• nodejs / server: Monitor NocoDB application logs for unusual JavaScript execution patterns or error messages related to input validation. Use grep to search for suspicious script tags or event handlers in log files.

grep -i 'script src=' /var/log/nocodb/app.log

• generic web: Use curl to test various input fields for XSS vulnerabilities. Check response headers for X-XSS-Protection and Content-Security-Policy headers.

curl -H "X-XSS-Protection: 1" https://your-nocodb-instance.com/search?q='<script>alert(1)</script>

1. 2022-06-07Disclosure

   disclosure

1. Gereserveerd2022-06-07
2. Gepubliceerd2022-06-07
3. Gewijzigd2024-08-03
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2022-2022 is to immediately upgrade NocoDB to version 0.91.7 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data within NocoDB. While not a complete solution, a Web Application Firewall (WAF) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review NocoDB's access control lists and ensure users have only the necessary permissions to perform their tasks. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through a user input field and verifying it is properly sanitized.