T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/nocodb.sh:7
- Finding
- Unrestricted NocoDB Endpoint Can Expose API Credentials and Uploaded Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/nocodb.sh:7-24` **Vulnerability Type**: Unvalidated remote endpoint used for authenticated requests **Risk Level**: Medium ### Vulnerable Code ```bash NC_URL="${NOCODB_URL:-https://app.nocodb.com}" NC_TOKEN="${NOCODB_TOKEN:-}" NC_VERBOSE="${NOCODB_VERBOSE:-0}" [[ -z "$NC_TOKEN" ]] && { echo "NOCODB_TOKEN required" >&2; exit 1; } # Verbose helper - shows resolved IDs _v() { [[ "$NC_VERBOSE" == "1" ]] && echo "→ $*" >&2 || true; } ############################################################################### # HTTP helpers ############################################################################### _get() { curl -sS -H "xc-token: $NC_TOKEN" "$NC_URL/api/v3/$1"; } _post() { curl -sS -X POST -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _patch() { curl -sS -X PATCH -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _put() { curl -sS -X PUT -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _delete() { curl -sS -X DELETE -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" ${2:+-d "$2"}; } _upload() { curl -sS -X POST -H "xc-token: $NC_TOKEN" -F "file=@$2" "$NC_URL/api/v3/$1"; } ``` The configurable endpoint is also documented without any HTTPS-only or trusted-host restriction at `SKILL.md:34-36`: ```bash export NOCODB_TOKEN="your-api-token" export NOCODB_URL="https://app.nocodb.com" # optional, this is default export NOCODB_VERBOSE=1 # optional, shows resolved IDs ``` ### Technical Analysis `NOCODB_URL` is trusted directly as the destination for every HTTP request. The script does not validate its scheme, hostname, port, or relationship to an expected NocoDB deployment. It consequently permits cleartext HTTP and arbitrary attacker-controlled destinations. Every request transmits the privileged ...[truncated 1881 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse and validate `NOCODB_URL` before making any request. 2. Require HTTPS by default and reject cleartext HTTP unless a deliberate, clearly named development override is enabled. 3. Support a configurable allowlist of trusted NocoDB hostnames for managed or automated environments. 4. Reject malformed URLs, embedded user information, unexpected schemes, and option-like values. 5. Add explicit curl protocol controls and an option terminator where appropriate: ```bash curl --proto '=https' --proto-redir '=https' --fail-with-body --silent --show-error \ -H "xc-token: $NC_TOKEN" -- "$validated_url" ``` 6. Do not automatically send credentials after cross-origin redirects if redirect support is introduced later. 7. Before uploading a file to a non-default or newly configured host, display the resolved destination and require explicit confirmation in interactive use. 8. Document the trust implications of changing `NOCODB_URL`, including that the configured server receives both the API token and uploaded data. ]]>