GHSA-v8vm-cqh8-q87q: NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass Summary The checkSQL() function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete: it only checks for a subset of dangerous PostgreSQL system functions and does not restrict access to sensitive system catalog tables such as pg_shadow, pg_roles, or pg_stat_activity. An authenticated user with the admin role can exploit this to dump PostgreSQL password hashes (pg_shadow), read all NocoBase user credentials (hashed passwords from the users table), and enumerate the full database schema — all data that admin users should never be able to access through the application interface. Affected Component File: packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts export const checkSQL = (sql: string) => { const dangerKeywords = [ // PostgreSQL — BLOCKED 'pg_read_file', 'pg_read_binary_file', 'pg_stat_file', 'pg_ls_dir', 'pg_logdir_ls', 'pg_terminate_backend', 'pg_cancel_backend', 'current_setting', 'set_config', 'pg_reload_conf', 'pg_sleep', 'generate_series', // MySQL — BLOCKED 'LOAD_FILE', 'BENCHMARK', '@@global.', '@@session.', // SQLite — BLOCKED 'sqlite3_load_extension', 'load_extension', ]; // NOT BLOCKED: pg_shadow, pg_roles, pg_stat_activity, // information_schema, users table direct access, etc. sql = sql.trim().split(';').shift(); if (!/^select/i.test(sql) && !/^with([\s\S]+)select([\s\S]+)/i.test(sql)) { throw new Error('Only supports SELECT statements or WITH clauses'); } if (dangerKeywords.some((keyword) => sql.toLowerCase().includes(keyword.toLowerCase()))) { throw new Error('SQL statements contain dangerous keywords'); } }; The execute action in sql.ts passes user-supplied SQL directly through this insufficient check: // sql.ts — execute action execute: async (ctx: Context, next: Next) => { const { sql } = ctx.action.para