| 제목 | nocodb <2026.08.1 Race Condition |
|---|
| 설명 | Signup enforced email uniqueness with a check-then-act sequence, so concurrent registration requests for one address could all pass the existence check and each create its own user record.
users.service.ts tested whether an address was already taken through the canonical-email and email lookups, then later inserted the new row via User.ts. The pair was neither wrapped in a transaction nor backed by a uniqueness constraint on the email or canonical-email columns of the metadata users table, and two deliberately slow bcrypt operations — salt generation and hashing at cost factor 10 — sat inside the window, so a batch of simultaneously released requests cleared the check together without any precise timing on the attacker's part. The existing defence against alias abuse, which canonicalizes the address and rejects plus-addressing, operates on the value of the address and offered no protection against concurrency.
|
|---|
| 원천 | ⚠️ https://github.com/nocodb/nocodb/issues/14686 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2026. 09. 29. AM 10:49 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 25. AM 10:23 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426189 [NocoDB 까지 2026.08.0 Registration users.service.ts 경쟁 조건] |
|---|
| 포인트들 | 20 |
|---|