CVE-2022-2064
📋 TL;DR
This vulnerability allows attackers to maintain access to NoCodeDB sessions beyond intended expiration times, potentially leading to unauthorized access. It affects all users running NoCodeDB versions prior to 0.91.7+. The insufficient session expiration means authenticated sessions remain valid longer than security policies intend.
💻 Affected Systems
- NoCodeDB
📦 What is this software?
Nocodb by Nocodb
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent unauthorized access to sensitive data and administrative functions, potentially leading to data theft, manipulation, or complete system compromise.
Likely Case
Unauthorized users maintain access to user accounts they shouldn't have, leading to data exposure and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation and additional authentication layers, though session management remains flawed.
🎯 Exploit Status
Exploitation requires initial authentication but session persistence is trivial once obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.91.7+
Vendor Advisory: https://github.com/nocodb/nocodb/commit/c9b5111b25aea2781e19395a8e9107ddbd235a2b
Restart Required: Yes
Instructions:
1. Backup your NoCodeDB instance and data. 2. Update to version 0.91.7 or later using your package manager or deployment method. 3. Restart the NoCodeDB service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Force Session Termination
allManually terminate all active sessions and implement shorter session timeouts
Restart NoCodeDB service to clear all sessions
Configure session timeout to minimum acceptable value
🧯 If You Can't Patch
- Implement network segmentation to isolate NoCodeDB instances from sensitive systems
- Deploy additional authentication layers (MFA, IP whitelisting) and monitor session activity closely
🔍 How to Verify
Check if Vulnerable:
Check NoCodeDB version via web interface or configuration files. If version is below 0.91.7, system is vulnerable.Check Version:
Check NoCodeDB web interface admin panel or review package.json/application configuration for version numberVerify Fix Applied:
Confirm version is 0.91.7 or higher and test session expiration behavior matches configured timeout policies.📡 Detection & Monitoring
Log Indicators:
- Unusually long session durations
- Multiple sessions from same user overlapping beyond timeout
- Session renewal without re-authentication
Network Indicators:
- Sustained API calls from sessions that should have expired
- Authentication bypass patterns
SIEM Query:
source="nocodb" AND (session_duration > [configured_timeout] OR session_renewal_count > threshold)