Skip to main content

Unrestricted Upload of File with Dangerous Type

CVE-2023-50717

Medium
5.4/10

Summary

NocoDB is software for building databases as spreadsheets. In versions 0.202.6 through 0.202.9, an attacker can upload a html file with malicious content. If the user tries to open that file in the browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attackers to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-434 - Unrestricted Upload of File with dangerous type

'Unrestricted file upload with dangerous type' attacks involve an attacker uploading or transferring files of dangerous types to the server. The severity of such an attack depends upon the execution mechanism and the storage location of the uploaded file. Thus, it may range from simple defacement to arbitrary file execution, and complete system takeover.

References

Advisory Timeline

  • Published