GHSA-ghvf-qf6h-g8x5: NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Two vulnerabilities were identified and chained to achieve authenticated remote code execution

The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an unsanitized documentRoot value to the storages:update API. The second vulnerability allows the same admin to trigger Node.js require() on any absolute filesystem path via the pm:enable plugin manager endpoint, which accepts user-supplied paths with no validation (Local File Inclusion).

Chained together, these two flaws allow an attacker with admin credentials to write a malicious file and have it trigger on the system achieving remote code execution.

A working proof-of-concept exploit chain was developed and verified, requiring only a valid admin session token.

The file-manager plugin’s storage update endpoint accepts an arbitrary documentRoot value without validation. An authenticated admin can overwrite a storage record’s documentRoot to any absolute path on the filesystem, then upload files that land anywhere the Node.js process (root in default Docker deployments) can write including the web root, the application source directory, or system paths.