The application utilizes the pg driver, which supports stacked SQL statements. Coupled with the default PostgreSQL container configuration where the nocobase database user is granted superuser privileges (rolsuper=true), an attacker can execute arbitrary system commands using the COPY ... TO PROGRAM syntax. This vulnerability leads to full database compromise, including sensitive data exfiltration (such as administrator password hashes) and remote code execution within the database container.

Attack Chain

1. Attacker interacts with the /api/auth:signUp endpoint to create a new user account, exploiting the default allowSignUp: true configuration.
2. Attacker performs an authentication request to /api/auth:signIn to obtain a valid member role JSON Web Token (JWT).
3. Attacker identifies the vulnerable filter[latestMsgReceiveTimestamp][$lt] parameter on the /api/myInAppChannels:list endpoint.
4. Attacker validates the injection point using a time-based oracle payload (e.g., PG_SLEEP(5)).
5. Attacker crafts a malicious HTTP GET request containing a stacked-statement SQL payload using COPY ... TO PROGRAM.
6. The backend database executes the injected command with the privileges of the postgres system user (uid 999).
7. Attacker achieves command execution and can exfiltrate sensitive collections or system data from the host container.

Impact

Successful exploitation allows unauthenticated attackers to gain full access to the NocoBase database. The impact includes the exfiltration of sensitive information, such as administrator credentials (stored as PBKDF2 hashes), and remote code execution within the database container, which may facilitate lateral movement or further environment compromise.

Recommendation

• Upgrade NocoBase to version 2.0.61 or later immediately.
• Disable anonymous sign-ups by modifying the auth-basic configuration if registration is not required.
• Review database role privileges and ensure the PostgreSQL user configured for NocoBase follows the principle of least privilege rather than running as a superuser.
• Deploy the provided Sigma rule to detect anomalous requests to the /api/myInAppChannels:list endpoint.