NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in NocoDB's Page Leaving Warning page (PageLeavingWarning.vue). The component directly reads the ncRedirectUrl and ncBackUrl query parameters from the route and assigns them to window.location.href and an ` tag's href` attribute without any validation or sanitization [1][2].

Exploitation

When the helper function isSameOriginUrl() returns false (which occurs for non-http schemes like javascript:), the raw URL is passed to window.location.href, executing arbitrary JavaScript. An attacker can craft a malicious link containing a javascript: URI in one of these parameters and send it to a victim. The attack requires no authentication to succeed [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the NocoDB application, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of the victim. The attack is reflected (not stored), so the malicious payload is delivered directly via the crafted link [1][2].

Mitigation

As of the advisory publication, the vulnerability has been acknowledged. Users should check for patches or updates from NocoDB. No workaround is described; the recommended action is to apply the vendor-supplied fix when available [1][2].