Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@nocobase/server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmPublished

    NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

    GHSA-ghvf-qf6h-g8x5

    Affected
    • npm @nocobase/server < 2.1.5
    Fixed in
    2.1.5· Vendor fix available
    Issue
    Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an unsanitized documentRoot value to the storages:update API. The second vulnerability allows the same admin to trigger Node.js require() on any absolute filesystem path via the pm:enable plugin manager endpoint, which accepts user-supplied paths with no validation (Local File Inclusion). Chained together, these two flaws allow an attacker with admin credentials to write a malicious file and have it trigger on the system achieving remote code execution. A working proof-of-concept exploit chain was developed and verified, requiring only a valid admin session token. VULN 1: Arbitrary File Write via storages:update documentRoot Manipulation Summary The file-manager plugin's storage update endpoint…

    Recommended action: Upgrade to 2.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →