CVE-2022-2339
📋 TL;DR
CVE-2022-2339 is a Server-Side Request Forgery (SSRF) vulnerability in NocoDB that allows attackers to make requests to internal network resources from the vulnerable server. This can lead to sensitive information disclosure from internal systems. Users running vulnerable versions of NocoDB are affected.
💻 Affected Systems
- NocoDB
📦 What is this software?
Nocodb by Nocodb
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network resources accessible to the server, including cloud metadata services, internal APIs, and sensitive data stores.
Likely Case
Information disclosure from internal services, potentially including credentials, configuration data, and proprietary information.
If Mitigated
Limited impact with proper network segmentation and egress filtering in place.
🎯 Exploit Status
Exploitation requires some level of access to the NocoDB interface, but the SSRF technique itself is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions including commit 000ecd886738b965b5997cd905825e3244f48b95
Vendor Advisory: https://github.com/nocodb/nocodb/commit/000ecd886738b965b5997cd905825e3244f48b95
Restart Required: Yes
Instructions:
1. Update NocoDB to version containing commit 000ecd886738b965b5997cd905825e3244f48b95 or later. 2. Restart the NocoDB service. 3. Verify the fix by testing SSRF attempts.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from NocoDB servers to only necessary external resources.
Input Validation
allImplement URL validation to reject internal IP addresses and localhost requests.
🧯 If You Can't Patch
- Implement strict network egress filtering to block requests to internal IP ranges from the NocoDB server.
- Use a reverse proxy or WAF to filter and validate all outbound requests from the application.
🔍 How to Verify
Check if Vulnerable:
Check if NocoDB version is older than commit 000ecd886738b965b5997cd905825e3244f48b95. Test by attempting to make a request to internal resources through the application.Check Version:
Check NocoDB version in application interface or deployment configuration.Verify Fix Applied:
After patching, attempt SSRF attacks to internal addresses and verify they are blocked or properly validated.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from NocoDB server to internal IP addresses
- Requests to cloud metadata endpoints (169.254.169.254, etc.)
Network Indicators:
- HTTP traffic from NocoDB server to internal network segments not normally accessed
SIEM Query:
source_ip="nocoDB_server_ip" AND dest_ip IN (RFC1918_ranges, 127.0.0.0/8, 169.254.169.254)