T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/nocodb.sh:7- Finding
Unrestricted NocoDB Endpoint Can Expose API Credentials and Uploaded Files
- Content
View full analysis
&2; exit 1; } # Verbose helper - shows resolved IDs _v() { [[ "$NC_VERBOSE" == "1" ]] && echo "→ $*" >&2 || true; } ############################################################################### # HTTP helpers ############################################################################### _get() { curl -sS -H "xc-token: $NC_TOKEN" "$NC_URL/api/v3/$1"; } _post() { curl -sS -X POST -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _patch() { curl -sS -X PATCH -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _put() { curl -sS -X PUT -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _delete() { curl -sS -X DELETE -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" ${2:+-d "$2"}; } _upload() { curl -sS -X POST -H "xc-token: $NC_TOKEN" -F "file=@$2" "$NC_URL/api/v3/$1"; } ``` The configurable endpoint is also documented without any HTTPS-only or trusted-host restriction at `SKILL.md:34-36`: ```bash export NOCODB_TOKEN="your-api-token" export NOCODB_URL="https://app.nocodb.com" # optional, this is default export NOCODB_VERBOSE=1 # optional, shows resolved IDs ``` ### Technical Analysis `NOCODB_URL` is trusted directly as the destination for every HTTP request. The script does not validate its scheme, hostname, port, or relationship to an expected NocoDB deployment. It consequently permits cleartext HTTP and arbitrary attacker-controlled destinations. Every request transmits the privileged ...[truncated 1881 chars]- Remediation
View remediation