PkgSeer

Vulnerability GHSA-x4vh-j75g-268g

Medium Risk

8 months ago

NocoDB's Refresh Tokens Not Revoked on Password Reset

<0.301.3

Summary

NocoDB's Refresh Tokens Not Revoked on Password Reset

Details

Summary

The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.

Details

passwordReset() in users.service.ts updated token_version (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not token_version. Both passwordChange() and signOut() correctly deleted all refresh tokens.

Impact

An attacker who previously obtained a refresh token retains access after password reset until the token expires.

Credit

This issue was reported by @bugbunny-research (bugbunny.ai).

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

<=0.301.3 GHSA-hmcr-rmjq-47qr

NocoDB: Server-Side Request Forgery via Base Migration URL

<=0.301.3 GHSA-h6vv-pcq8-7xm4

NocoDB: Stored Cross-Site Scripting via Secure Attachment

<=0.301.3 GHSA-6mhr-74x2-98v9

NocoDB: Refresh Tokens Persist Through Password Recovery

<=0.301.3 GHSA-r989-7g3j-wjhw

NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL

<=0.301.3 GHSA-gprh-27j3-g5h4

View all vulnerabilities for these packages

Impacted packages

nocodb

Timeline

Published

8 months ago

Fixed (0.301.3)

8 months ago

Last Modified

9 hours ago