T09 · Insecure Skill Coding Practices
- Location
scripts/noco.sh:7- Finding
Unvalidated NocoDB Endpoint Can Disclose the API Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/noco.sh, lines 7 and 16–21
Vulnerability Type: Credential disclosure through an unrestricted configurable endpoint
Risk Level: MediumVulnerable Code
bash NC_URL="${NOCODB_URL:-https://app.nocodb.com}" NC_TOKEN="${NOCODB_TOKEN:-}" NC_VERBOSE="${NOCODB_VERBOSE:-0}" [[ -z "$NC_TOKEN" ]] && { echo "NOCODB_TOKEN required" >&2; exit 1; } # Verbose helper - shows resolved IDs _v() { [[ "$NC_VERBOSE" == "1" ]] && echo "→ $*" >&2 || true; } ############################################################################### # HTTP helpers ############################################################################### _get() { curl -sS -H "xc-token: $NC_TOKEN" "$NC_URL/api/v3/$1"; } _post() { curl -sS -X POST -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _patch() { curl -sS -X PATCH -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _put() { curl -sS -X PUT -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; } _delete() { curl -sS -X DELETE -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" ${2:+-d "$2"}; } _upload() { curl -sS -X POST -H "xc-token: $NC_TOKEN" -F "file=@$2" "$NC_URL/api/v3/$1"; }Technical Analysis
The script accepts
NOCODB_URLwithout validating its scheme, host, embedded credentials, or destination. Every HTTP helper then sends the value ofNOCODB_TOKENin thexc-tokenrequest header to that endpoint.Custom endpoints are legitimate for self-hosted NocoDB deployments, but the implementation does not establish a minimum transport-security policy. It accepts arbitrary destinations and plain HTTP URLs. Consequently, a mistaken or attacker-influenced environment value can cause the credential to be transmitted to an attacker-controlled server. When HTTP is used, network-positioned attackers may als ...[truncated 1438 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse and validate
NOCODB_URLbefore making any request. - Require HTTPS by default and reject all other schemes.
- Permit plain HTTP only through an explicit development override restricted to loopback hosts such as
localhost,127.0.0.1, and[::1]. - Reject malformed URLs, embedded user information, fragments, unexpected control characters, and ambiguous host representations.
- Consider an explicit allowlist for approved NocoDB hosts. At minimum, require confirmation or a dedicated opt-in flag when using a host other than the default.
- Normalize the configured URL and remove trailing slashes before appending API paths.
- Preserve TLS certificate verification and do not add insecure
curloptions such as-kor--insecure. - Use narrowly scoped, least-privilege API tokens and rotate a token immediately if it may have been transmitted to an untrusted destination.
- Document that changing
NOCODB_URLchanges the recipient of the API credential and should only be done for trusted NocoDB deployments. - Add automated tests confirming rejection of plain HTTP remote endpoints, embedded credentials, malformed URLs, and unauthorized hosts.
- Parse and validate