Lucene search

K
huntrHisokix094639D8E-8301-4432-AB80-E76E1346E631
HistoryJun 16, 2022 - 7:50 a.m.

The NocoDB application allows large characters to insert in the input field "New Project" on the create field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request

2022-06-1607:50:49
hisokix0
www.huntr.dev
20
nocodb
dos attack
http request
input validation
excessive characters
security vulnerability
patch recommendation

EPSS

0.001

Percentile

31.9%

Proof of Concept

Go to http://localhost:8080/dashboard/#/projects
Click on New project and create
Fill the “Enter project name” field with huge characters, (more than 1 lakh)
Copy the below payload and put it in the input fields and click on continue.
You will see the application accepts large characters and if we will increase the characters then it can lead to Dos.

Download the payload from here:

https://drive.google.com/file/d/13IK67Sx93nvnb_3gLUBDLgoEC7XTQiso/view?usp=sharing

Video & Image POC:

https://drive.google.com/drive/folders/1N6h02blexPhQyj4MdfyPwNTOmKEXIfMu?usp=sharing

Patch recommendation:

The Project name input should be limited to 50 characters or a max of 100 characters.

EPSS

0.001

Percentile

31.9%

Related for 94639D8E-8301-4432-AB80-E76E1346E631