Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a vulnerability in NocoDB related to how it handles refresh tokens for user authentication. A race condition allows an attacker to potentially reuse a captured refresh token, enabling them to obtain a valid authenticated session without detection. This impacts systems relying on NocoDB for secure access to their data.
- Attackers can reuse authentication tokens.
- Critical for confirming exposure in web-facing systems.
- Verify NocoDB usage and assess access controls.
Attack Path
How an attacker could exploit the issue
An attacker starting with a captured refresh token can exploit a race condition in NocoDB's token rotation process. This vulnerability in the UserRefreshToken.ts file allows the attacker to reuse the captured token by presenting it concurrently with the legitimate user's token. If successful, the attacker can obtain a valid authenticated session without the system detecting the token reuse, potentially leading to unauthorized access and control.
- Requires a stolen refresh token.
- Triggers during concurrent token rotation.
- Risk of unauthorized session takeover.
Live Threat
Current exploitation, exposure, and threat context
A race condition in refresh-token rotation could allow an attacker to reuse a captured refresh token to obtain an authenticated session, provided the affected row count is not checked. This could lead to unauthorized access to the system.
- User session data.
- Concurrent token presentation.
- Unauthorized session access.
Operational Fix
Recommended remediation, mitigation, and detection steps
The critical race condition in NocoDB's refresh token rotation requires immediate attention from teams managing application infrastructure and user authentication. The first step is to inventory all NocoDB instances, determine their exposure, and identify the business-criticality of each deployment. This will inform the prioritization of remediation efforts, likely involving application owners and platform teams, and potentially vendor coordination for patching.
- Identify application and platform owners.
- Verify NocoDB instance exposure and criticality.
- Plan vendor-coordinated patching or mitigation.
