cve/2023/CVE-2023-35843.md

CVE-2023-35843

Description

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.

POC

Reference

• https://advisory.dw1.io/60

Github

• https://github.com/0x783kb/Security-operation-book
• https://github.com/Lserein/CVE-2023-35843
• https://github.com/Szlein/CVE-2023-35843
• https://github.com/Tropinene/Yscanner
• https://github.com/b3nguang/CVE-2023-35843
• https://github.com/codeb0ss/cve-202335843
• https://github.com/nomi-sec/PoC-in-GitHub