NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the @nocobase/plugin-action-custom-request plugin. A low-privileged authenticated user can call the customRequests:send endpoint and override the stored request URL at runtime using options.url. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs. Product: NocoBase Version: v2.1.10 Component: @nocobase/plugin-action-custom-request Severity: Moderate Required privilege: authenticated low-privileged user / member Testing was performed only in a local Docker …