Budibase vulnerabilities

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

Budibase is an open-source low-code platform that prior to version 3.39.0 had security vulnerabilities related to access to GET and PUT routes for single data sources. Basic role users could access sensitive information such as authorization secrets by manipulating configuration data.

Budibase is an open-source low-code platform that prior to version 3.38.3 did not properly mask sensitive data in the Snowflake integration. An authenticated BASIC user could retrieve the full PEM key in plaintext.

Budibase is an open-source low-code platform. Prior to version 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users, allowing authenticated builders to upload dangerous files.

Budibase prior to version 3.38.1 has a vulnerability in its REST API that allows authenticated app users to modify datasource configurations. Users with BASIC role or higher can send PUT requests to change settings, potentially leading to unauthorized access to sensitive data.

Budibase is an open-source low-code platform that prior to version 3.38.1 had a vulnerability in the POST /api/global/users/onboard endpoint. This allows builder-level users to create new global admin accounts, leading to privilege escalation.

Budibase is an open-source low-code platform. In versions prior to 3.34.8, the processUrlFile function in extract.ts did not validate IP addresses, allowing authenticated users to send requests to internal network addresses.

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

Budibase prior to 3.39.30 has a vulnerability in the OIDC flow, where the email is not verified for email_verified, and accounts are linked based on email. An attacker who can authenticate through an identity provider with an unverified victim email can take over the victim's account and inherit their roles.

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources.

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

Budibase prior to 3.40.1 did not verify that the final request destination matches the datasource origin, allowing an unauthenticated caller of a public query endpoint to supply an attacker-controlled host and receive stored credentials. This issue is fixed in version 3.40.1.

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.

Budibase before version 3.39.9 contains a vulnerability due to improper validation of symbolic links during ZIP file processing. A builder-level attacker can inject a symbolic link pointing to any file on the system, which will be read and uploaded to MinIO, then served via the API.

Budibase before version 3.39.12 contains a vulnerability that allows an unauthenticated user to read all documents from MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collections, and if a public write query exists, to modify all documents in a single HTTP request. The issue stems from improper input validation in the validateQueryInputs function, which only rejects Handlebars markers but does not escape JSON metacharacters, enabling injection of additional fields into the filter object.

Budibase prior to version 3.39.0 contains a vulnerability allowing an anonymous attacker to obtain a pre-signed PUT URL for any S3 bucket the victim has access to. The attack requires knowledge of a workspace ID and S3 datasource ID but no authentication.

Budibase is a low-code platform that prior to version 3.39.0 had a vulnerability in the /api/public/v1/roles/assign endpoint. It allows users with builder roles to promote themselves to global admin, leading to tenant-wide privilege escalation.

Budibase prior to version 3.33.4 allows an unauthenticated attacker to achieve Remote Code Execution (RCE) on the server by triggering an automation that contains a Bash step via the public webhook endpoint. The process executes as root inside the container.

Budibase prior to version 3.33.4 has a Server-Side Request Forgery (SSRF) vulnerability in the REST datasource connector. The SSRF protection mechanism (IP blacklist) is ineffective because the BLACKLIST_IPS environment variable is not set by default in any official deployment configuration. When empty, the blacklist function unconditionally returns false, allowing all requests through.

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/* endpoints to disable premium features and downgrade deployments for all users.

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant.

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

Budibase prior to version 3.39.19 has a vulnerability in the PostgreSQL datasource connector where the user-controlled schema field is interpolated into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator to execute arbitrary SQL.

Budibase prior to version 3.41.3 has a vulnerability in the POST /api/attachments/:datasourceId/url endpoint, where an authenticated published-app user with the BASIC role can supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials.

Budibase prior to version 3.41.3 has a vulnerability in automation steps (outgoingWebhook, zapier, n8n, slack, discord) where they use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement, allowing an authenticated user to make server-side requests to cloud metadata and internal services.

Budibase prior to 3.39.18 contains a SQL injection vulnerability in the MySQL integration where the table name is not properly escaped in a DESCRIBE statement. An attacker can create a table with a name containing a backtick and stacked statement, which executes during schema discovery by an administrator. Fixed in version 3.39.18.

Budibase prior to 3.39.24 has a vulnerability in the POST /api/public/v1/roles/assign endpoint where appBuilder.appId or role.appId is not validated. An app-scoped builder can grant themselves builder access or arbitrary roles in another app, exposing data, datasource configuration, and automations. Fixed in version 3.39.24.

Budibase prior to version 3.39.25 has a vulnerability in the GET /api/users/metadata and GET /api/users/metadata/:id endpoints. Responses include user objects without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role can retrieve identity-provider credentials of SSO-authenticated users and use refresh tokens for persistent access to connected services.

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations via the read API to obtain live backend database credentials and service account keys.

Budibase before 3.40.0 contains an authorization/authentication bypass in the PUT /api/global/users/tenant/owner endpoint. On self-hosted instances, any authenticated user, including a lowest-privilege BASIC app user, can reassign the tenant account-holder email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.

Budibase prior to 3.39.32 exposes the GET /api/global/users/tenant/:id endpoint in PUBLIC_ENDPOINTS, and tenantUserLookup returns a full PlatformUser document. An unauthenticated caller could enumerate users and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata.

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI table-generation feature could cause an attachment value to reference an internal service or cloud metadata endpoint, and the response would be stored as an attachment without fetchWithBlacklist validation. This issue is fixed in version 3.39.4.

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.

In Budibase prior to 3.39.25, the GET /api/global/groups endpoint omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings, user memberships, builder permissions, and default-group flags.

Budibase before version 3.38.1 contains a server-side request forgery (SSRF) vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.

Budibase before version 3.39.9 is vulnerable to SSRF via DNS rebinding. Authenticated users with automation permissions can bypass the IP blacklist because hostname validation before the request is not pinned to the actual connection.

Budibase prior to version 3.39.9 has a vulnerability in the webhook trigger endpoint, which is publicly accessible and passes the full HTTP request body into automation execution parameters. An attacker can overwrite the internal appId property, allowing automation execution in the victim's context and granting full read/write access to the victim's database.

Budibase prior to 3.39.3 exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials from a workspace datasource. The route is protected only by recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access.

A vulnerability in Budibase before 3.39.0 allows an attacker to permanently link a victim's account to an external chat identity (Slack/Discord/MS Teams) without user consent. The public endpoint lacks authentication and CSRF protection, and the attack requires tricking an authenticated user into visiting a crafted URL.

Budibase before version 3.33.4 contains a path traversal vulnerability in the plugin file upload endpoint (POST /api/plugin/upload). An attacker with Global Builder privileges can upload a file with a filename containing ../, allowing deletion of arbitrary directories and writing arbitrary files to the filesystem.

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution.