CVE-2023-49781: 
JavaScript vulnerability analysis and mitigation

NocoDB, a software for building databases as spreadsheets, was found to contain a stored cross-site scripting vulnerability (CVE-2023-49781) in versions prior to 0.202.9. The vulnerability exists within the Formula virtual cell comments functionality, specifically in the nc-gui/components/virtual-cell/Formula.vue component (GitHub Advisory).

The vulnerability stems from the Formula.vue component which displays a v-html tag with the value of 'urls'. The content is processed by the replaceUrlsWithLink() function, which recognizes the pattern URI::(XXX) and creates a hyperlink tag with href=XXX. However, the function leaves all other contents outside of the URI::(XXX) pattern unchanged, potentially allowing for injection of malicious content. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.3 (HIGH) with the vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (NVD).

The vulnerability could allow authenticated attackers to inject arbitrary web scripts into the application, potentially leading to the execution of malicious code in the context of other users' browsers. This could result in the theft of sensitive information, session hijacking, or other malicious actions.

The vulnerability requires an authenticated user to create a malicious table with a formula field containing the exploit payload. The attack complexity is considered low, but it does require user interaction and low-level privileges to execute.

The vulnerability has been fixed in NocoDB version 0.202.9. Users are strongly advised to upgrade to this version or later. The fix involves implementing proper sanitization of formula text before rendering (GitHub Commit).