Description

A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T21:17:14.390Z",
  "pubdate": "2026-09-21T21:17:14.390Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in NocoBase version 2.1.21. The flaw exists within the serverRequest function, which fails to adequately sanitize or restrict user-supplied input before executing outbound HTTP requests.\nThis vulnerability allows an authenticated attacker to manipulate the server into making arbitrary requests to internal network resources that are otherwise inaccessible from the external perimeter. By leveraging this capability, an attacker can bypass firewalls and network segmentation to interact with internal services, cloud metadata endpoints, or local databases.\nThe risk implication is significant, as it facilitates internal reconnaissance, potential data exfiltration, or the exploitation of vulnerable services residing within the internal network infrastructure. Successful exploitation requires an authenticated session, but once authenticated, the attacker gains the ability to utilize the NocoBase server as a proxy to conduct malicious operations against internal targets.\nOrganizations using NocoBase 2.1.21 are advised to implement strict egress filtering and request validation to mitigate the risk of unauthorized internal resource access.",
  "technicalDetails": "The vulnerability is localized to the serverRequest function, which serves as a backend utility for processing remote HTTP requests. The root cause is the lack of robust input validation and blacklisting of internal IP ranges, loopback addresses, or sensitive hostnames within the URI parameters passed to the function.\nIn NocoBase version 2.1.21, the application allows authenticated users to trigger requests that are processed server-side. When the serverRequest function is invoked, it accepts a target URL without verifying that the destination is safe or authorized for outbound communication. Because the application does not validate the destination host or enforce a strict whitelist of allowed domains, an attacker can craft a malicious HTTP request that directs the server to reach out to internal resources.\nThe attack flow begins with the attacker establishing an authenticated session. Once authenticated, the attacker identifies an interface or feature that utilizes the serverRequest function to fetch remote data. By modifying the target URL parameter—for instance, changing an expected external URL to an internal one such as http://127.0.0.1:8080/admin or http://169.254.169.254/latest/meta-data/—the attacker instructs the server to perform a GET or POST request to the specified target.\nThe server, acting as a proxy, initiates the request to the internal destination. The response from the internal service, which might include internal service configuration pages, headers, or API tokens, is then returned to the attacker through the application's interface. This circumvents network security controls such as perimeter firewalls or internal Access Control Lists (ACLs) that would otherwise block direct access to these assets.\nThe payload behavior involves the systematic enumeration of the internal network architecture, including the identification of non-public services running on localhost or other network segments. Post-exploitation, an attacker may leverage this access to exploit internal vulnerabilities, retrieve sensitive configuration files, or interact with cloud-specific metadata services if the application is hosted in a cloud environment. This effectively elevates the attacker's ability to perform reconnaissance and lateral movement within the hosting infrastructure."
}