JEDI-SEC | Security Research & Digital Defense

GHSA-wrr5-j383-f7h2: NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

Written by

jedisec_u136k7

in

  • Severity: MEDIUM
  • CVE: CVE-2026-79914
  • Ecosystems: npm, npm
  • Packages: @nocobase/plugin-action-custom-request, @nocobase/plugin-action-custom-request

### Summary

A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin.

A low-privileged authenticated user can call the `customRequests:send` endpoint and override the stored request URL at runtime using `options.url`. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs.

* Product: NocoBase
* Version: v2.1.10
* Component: `@nocobase/plugin-action-custom-request`
* Severity: Moderate
* Required privilege: authenticated low-privileged user / member

Testing was performed only in a local Docker lab environment at `http://127.0.0.1:13000`. No public NocoBase instance was tested.

Lab environment:

* Docker image: `nocobase/nocobase:latest-full`
* Commit: `23e2bd35625439594e4757bac31d57c9e8e695b9`
* Database: PostgreSQL 16
* Containers: `nocobase-lab`, `nocobase-postgres`
* Docker network: `172.19.0.0/16`
* Important environment variable: `SERVER_REQUEST_WHITELIST` was not set

—

### Details

The vulnerable endpoint is:

“`http
POST /api/customRequests:send?filterByTk=
“`

The `customRequests:send` action is allowed for any logged-in user:

“`ts
// plugin-action-custom-request/src/server/plugin.ts
this.app.acl.allow(‘customRequests’, [‘send’, ‘listByCurrentRole’], ‘loggedIn’);
“`

The request options supplied at runtime are merged into the stored request configuration. This allows a low-privileged user to override the stored URL:

“`ts
// plugin-acti…

Source: GitHub Security Advisories · 2026-11-10

More posts