NocoBase Authenticated Remote Code Execution via File Write and LFI Chain

NocoBase versions prior to 2.1.5 contain a high-severity authentication-based remote code execution (RCE) chain. The vulnerability arises from two distinct flaws in the API surface that allow an authenticated administrative user to bypass file system protections. First, the storages:update API fails to validate the documentRoot parameter, enabling an attacker to redirect the application's file storage root to arbitrary locations on the host disk, including system or application directories. Second, the pm:enable endpoint performs an unsanitized require() call on a user-supplied filterByTk parameter, acting as a local file inclusion (LFI) primitive. By uploading a malicious JavaScript file to the application directory using the first vulnerability and subsequently triggering it via the LFI endpoint, an attacker can execute arbitrary code within the Node.js server process. The LFI primitive can also be exploited independently to induce error-based disclosure of sensitive system files.

Attack Chain

1. Attacker authenticates to the NocoBase instance with administrative credentials.
2. Attacker queries the /api/storages endpoint to identify the filterByTk ID for the active local storage configuration.
3. Attacker sends a POST request to /api/storages:update with a crafted documentRoot parameter set to the application's root directory (e.g., ".").
4. Attacker uploads a malicious Node.js payload via the /api/attachments:upload endpoint, which is now saved to the application's base path due to the modified documentRoot.
5. Attacker calls the /api/pm:enable endpoint, supplying the path to the previously uploaded malicious file in the filterByTk parameter.
6. The application backend passes the unsanitized path directly to require(), executing the uploaded JavaScript payload.
7. The malicious code executes with the privileges of the NocoBase server process, achieving persistent RCE.

Impact

Successful exploitation grants an authenticated attacker full remote code execution on the underlying host. Given that NocoBase often runs with elevated privileges (e.g., as root in default Docker configurations), this leads to a complete compromise of the application and the host server. Additionally, the LFI primitive allows for the unauthorized reading of sensitive files from the server's filesystem, facilitating further reconnaissance or credential theft.

Recommendation

1. Immediately upgrade all NocoBase deployments to version 2.1.5 or later to resolve the missing input validation in the storage and plugin management components.
2. Audit administrative access logs for unauthorized access to the storages:update and pm:enable endpoints.
3. Restrict access to administrative API endpoints to trusted management networks.
4. Deploy the suggested Sigma rule to monitor for unusual require() activity originating from the plugin manager path.