Technical impact
The vulnerability is an unvalidated HEAD request made by the uploadViaURL endpoint in NocoDB versions prior to 0.301.0. This blind Server‑Side Request Forgery allows an attacker to cause the server to send a HEAD request to any URL of the attacker’s choosing before the subsequent download step applies the intended SSRF controls. The attacker can therefore probe or contact arbitrary external services, potentially gathering information or leaking minimal metadata, but cannot directly retrieve data from those services. This weakness is categorized as CWE‑918.
Affected Systems
The flaw affects the NocoDB application developed by nocodb. All releases before version 0.301.0 are vulnerable. End‑users using these versions should consult the NocoDB documentation to apply the update or disable the affected feature.
Risk and Exploitability
The CVSS v3.1 score is 4.9, indicating moderate risk, and the EPSS score is below 1 percent, suggesting exploitation likelihood is very low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to invoke the uploadViaURL API endpoint, typically via authenticated or unauthenticated access to the web application, to exploit the unverified request. Because the subsequent download logic enforces SSRF restrictions, the attack surface is limited to non‑data‑exfiltration probing. Nonetheless, if the system reaches out to sensitive internal resources, the blind SSRF could be leveraged for reconnaissance or to trigger side‑effects.
Github GHSA