NocoBase Authenticated SQL Injection to RCE

NocoBase versions 2.0.60 and earlier contain a critical SQL injection vulnerability in the /api/myInAppChannels:list endpoint. The vulnerability arises because the latestMsgReceiveTimestamp filter parameter is unsafely interpolated into a Sequelize.literal() template string without proper escaping or parameter binding. Because NocoBase defaults to allowing anonymous account registration (allowSignUp: true), any unauthenticated attacker can create an account and access this endpoint.

The application utilizes the pg driver, which supports stacked SQL statements. Coupled with the default PostgreSQL container configuration where the nocobase database user is granted superuser privileges (rolsuper=true), an attacker can execute arbitrary system commands using the COPY ... TO PROGRAM syntax. This vulnerability leads to full database compromise, including sensitive data exfiltration (such as administrator password hashes) and remote code execution within the database container.

Attack Chain

1. Attacker interacts with the /api/auth:signUp endpoint to create a new user account, exploiting the default allowSignUp: true configuration.
2. Attacker performs an authentication request to /api/auth:signIn to obtain a valid member role JSON Web Token (JWT).
3. Attacker identifies the vulnerable filter[latestMsgReceiveTimestamp][$lt] parameter on the /api/myInAppChannels:list endpoint.
4. Attacker validates the injection point using a time-based oracle payload (e.g., PG_SLEEP(5)).
5. Attacker crafts a malicious HTTP GET request containing a stacked-statement SQL payload using COPY ... TO PROGRAM.
6. The backend database executes the injected command with the privileges of the postgres system user (uid 999).
7. Attacker achieves command execution and can exfiltrate sensitive collections or system data from the host container.

Impact

Successful exploitation allows unauthenticated attackers to gain full access to the NocoBase database. The impact includes the exfiltration of sensitive information, such as administrator credentials (stored as PBKDF2 hashes), and remote code execution within the database container, which may facilitate lateral movement or further environment compromise.

Recommendation

• Upgrade NocoBase to version 2.0.61 or later immediately.
• Disable anonymous sign-ups by modifying the auth-basic configuration if registration is not required.
• Review database role privileges and ensure the PostgreSQL user configured for NocoBase follows the principle of least privilege rather than running as a superuser.
• Deploy the provided Sigma rule to detect anomalous requests to the /api/myInAppChannels:list endpoint.