{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@nocobase/server--2.1.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@nocobase/server (\u003c 2.1.5)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","lfi","nocobase","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["NocoBase"],"content_html":"\u003cp\u003eNocoBase versions prior to 2.1.5 contain a high-severity authentication-based remote code execution (RCE) chain. The vulnerability arises from two distinct flaws in the API surface that allow an authenticated administrative user to bypass file system protections. First, the \u003ccode\u003estorages:update\u003c/code\u003e API fails to validate the \u003ccode\u003edocumentRoot\u003c/code\u003e parameter, enabling an attacker to redirect the application's file storage root to arbitrary locations on the host disk, including system or application directories. Second, the \u003ccode\u003epm:enable\u003c/code\u003e endpoint performs an unsanitized \u003ccode\u003erequire()\u003c/code\u003e call on a user-supplied \u003ccode\u003efilterByTk\u003c/code\u003e parameter, acting as a local file inclusion (LFI) primitive. By uploading a malicious JavaScript file to the application directory using the first vulnerability and subsequently triggering it via the LFI endpoint, an attacker can execute arbitrary code within the Node.js server process. The LFI primitive can also be exploited independently to induce error-based disclosure of sensitive system files.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the NocoBase instance with administrative credentials.\u003c/li\u003e\n\u003cli\u003eAttacker queries the \u003ccode\u003e/api/storages\u003c/code\u003e endpoint to identify the \u003ccode\u003efilterByTk\u003c/code\u003e ID for the active local storage configuration.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to \u003ccode\u003e/api/storages:update\u003c/code\u003e with a crafted \u003ccode\u003edocumentRoot\u003c/code\u003e parameter set to the application's root directory (e.g., \u0026quot;.\u0026quot;).\u003c/li\u003e\n\u003cli\u003eAttacker uploads a malicious Node.js payload via the \u003ccode\u003e/api/attachments:upload\u003c/code\u003e endpoint, which is now saved to the application's base path due to the modified \u003ccode\u003edocumentRoot\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker calls the \u003ccode\u003e/api/pm:enable\u003c/code\u003e endpoint, supplying the path to the previously uploaded malicious file in the \u003ccode\u003efilterByTk\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe application backend passes the unsanitized path directly to \u003ccode\u003erequire()\u003c/code\u003e, executing the uploaded JavaScript payload.\u003c/li\u003e\n\u003cli\u003eThe malicious code executes with the privileges of the NocoBase server process, achieving persistent RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an authenticated attacker full remote code execution on the underlying host. Given that NocoBase often runs with elevated privileges (e.g., as root in default Docker configurations), this leads to a complete compromise of the application and the host server. Additionally, the LFI primitive allows for the unauthorized reading of sensitive files from the server's filesystem, facilitating further reconnaissance or credential theft.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately upgrade all NocoBase deployments to version 2.1.5 or later to resolve the missing input validation in the storage and plugin management components.\u003c/li\u003e\n\u003cli\u003eAudit administrative access logs for unauthorized access to the \u003ccode\u003estorages:update\u003c/code\u003e and \u003ccode\u003epm:enable\u003c/code\u003e endpoints.\u003c/li\u003e\n\u003cli\u003eRestrict access to administrative API endpoints to trusted management networks.\u003c/li\u003e\n\u003cli\u003eDeploy the suggested Sigma rule to monitor for unusual \u003ccode\u003erequire()\u003c/code\u003e activity originating from the plugin manager path.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-20T19:13:00Z","date_published":"2026-08-20T19:13:00Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nocobase-rce/","summary":"An authenticated admin can achieve remote code execution in NocoBase prior to v2.1.5 by chaining arbitrary file uploads via storage root manipulation with a local file inclusion vulnerability in the plugin manager.","title":"NocoBase Authenticated Remote Code Execution via File Write and LFI Chain","url":"https://feed.craftedsignal.io/briefs/2026-08-nocobase-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - @Nocobase/Server (\u003c 2.1.5)","version":"https://jsonfeed.org/version/1.1"}