@budibase/server@3.10.4

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Information Exposure via the rest integration process. An attacker can obtain sensitive authentication credentials by supplying a crafted absolute URL as a query parameter, causing the system to forward stored authorization headers to an attacker-controlled server. This is only exploitable if a REST datasource with stored authentication is used by a query published with the PUBLIC role.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the confirmChatLinkSession process. An attacker can gain unauthorized access to another user's permissions and perform actions as that user by inducing the victim to submit a crafted POST request containing a leaked confirmation token. This is only exploitable if the victim is authenticated within the same tenant and interacts with a malicious link or page while logged in.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization checks in the url endpoint for S3 attachments. An attacker can gain unauthorized access to generate S3 PutObject presigned URLs by sending crafted requests with arbitrary bucket parameters, allowing uploads to any S3 bucket accessible by the application's IAM credentials.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the POST /api/v2/email process. An attacker can gain unauthorized access to another user's account by supplying a victim's accountId and an email address they control, allowing them to change the victim's email and subsequently reset the password to take over the account. This is only exploitable if the attacker obtains the victim's accountId through channels outside the normal API surface.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the uploadUrl function when processing attachment column values during AI table generation. An attacker can access internal network resources and sensitive cloud metadata by submitting crafted prompts that cause the server to fetch attacker-controlled URLs, including internal IP addresses or cloud metadata endpoints.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Information Exposure via the automation test results broadcast process. An attacker can obtain sensitive OAuth2 access and refresh tokens belonging to other users by passively listening to WebSocket broadcasts or by polling the test status endpoint. This allows unauthorized access to external APIs and persistent access to external service accounts.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to SQL Injection via the multipleStatements configuration in the MySQL integration. An attacker can execute arbitrary SQL commands by injecting malicious input into user fields, potentially leading to data destruction, data theft, privilege escalation, denial of service, and complete database compromise.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify or delete arbitrary documents, and bypass intended query restrictions by injecting specially crafted JSON metacharacters into query parameters.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An attacker can enumerate the existence of arbitrary files and read file contents by supplying crafted absolute paths, receiving different error messages based on file presence and content.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch protections.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Incorrect Authorization via the assign process. An attacker can gain unauthorized access to other applications and assign elevated roles to themselves or other users by exploiting insufficient authorization checks in the role assignment API. This is only exploitable if the deployment is licensed with Business/Enterprise features enabled (i.e., isExpandedPublicApiEnabled is true).

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to SQL Injection in the json field enrichment process. An attacker can access unauthorized data, execute arbitrary JavaScript on the database server, perform cross-collection queries, or modify and delete data by injecting malicious input into query parameters.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access internal-only services, read sensitive data, or modify and delete internal resources by configuring a REST datasource to use a rebinding hostname that resolves to a safe public IP during validation but to an internal IP at connection time. This allows the attacker to make the server issue arbitrary HTTP requests to internal endpoints, potentially leading to credential theft, data exposure, or service disruption. This is only exploitable if the attacker has an authenticated account with permissions to configure or run a REST datasource.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by sending requests to these endpoints with sufficient privileges. This enables unauthorized access to external identity provider resources and persistent impersonation of affected users.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the executeQuery process. An attacker can make the server issue HTTP requests to internal network endpoints and potentially expose internal service data by supplying a crafted queryId and configuring a REST datasource to target internal infrastructure. This is only exploitable if the attacker has builder-level access to the application.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to SQL Injection via improper handling of user-supplied input in the schema configuration field and table name processing. An attacker can execute arbitrary SQL commands, compromise the database, and potentially execute operating system commands by injecting malicious input into configuration fields or table names that are directly interpolated into SQL queries without proper escaping or parameterization.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Arbitrary File Upload via file upload endpoint POST /api/attachments/process that does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions (html, svg, js, php, etc.) are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELF_HOSTED), meaning any authenticated builder can upload executable web conten.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the enrichContext process. An attacker can access and modify all documents in connected NoSQL databases by injecting crafted parameter values into query templates, which are improperly parsed and validated. This allows unauthorized read and write operations through a single HTTP request without authentication or CSRF protection. This is only exploitable if a workspace builder has set the role of a non-SQL query to PUBLIC and published the app.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Missing Authorization via the getSignedUploadURL process. An attacker can perform unauthorized arbitrary object uploads to S3 buckets by sending crafted requests to the unauthenticated endpoint, leveraging stored datasource credentials to write to attacker-controlled locations.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the handoffChatLinkSession process. An attacker can gain unauthorized access to another user's account by crafting a malicious link containing their own external chat identity and convincing an authenticated user to click it. This results in the attacker's chat identity being permanently mapped to the victim's account, allowing the attacker to perform actions and access data with the victim's permissions, without the victim's knowledge.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Symlink Attack via the processPWAZip process. An attacker can access sensitive files on the server by uploading a crafted zip archive containing symbolic links that point to arbitrary files, which are then read and served back through the asset-fetch endpoint. This is only exploitable if the attacker has workspace-builder permissions on at least one app.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the externalTrigger process. An attacker can gain unauthorized access to another workspace's database and execute arbitrary automations by supplying a crafted POST body that overrides internal properties such as appId. This allows the attacker to perform read and write operations, exfiltrate data, and execute scripts in the context of the victim's workspace by knowing the victim's workspace ID.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Missing Authorization via the getSignedUploadURL process. An attacker can gain unauthorized access to generate AWS S3 pre-signed PUT URLs using stored IAM credentials by sending unauthenticated requests to the affected endpoint with attacker-controlled parameters. This allows arbitrary file uploads to any bucket accessible by the IAM credentials, potentially leading to data exposure, data tampering, or resource exhaustion.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the fetchToken process. An attacker can access internal network resources and potentially sensitive data by supplying a crafted OAuth2 token endpoint URL that points to internal hosts or cloud metadata services, bypassing blacklist checks. This is only exploitable if the attacker has builder-level privileges to configure OAuth2 integrations.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Missing Authorization via the buildSchema controller. An attacker can modify schema metadata and automation trigger output schema by sending unauthenticated requests to the affected endpoint, potentially corrupting automation definitions, altering downstream binding behavior, and disrupting automation workflows.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the host parameter in the VectorDB configuration process. An attacker can enumerate internal network services and access sensitive internal endpoints by supplying arbitrary host values, causing the server to initiate outbound connections to internal or cloud metadata addresses on their behalf. This is only exploitable if the attacker has builder-level authenticated access.

Upgrade @budibase/server to version 3.35.3 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Incorrect Authorization in the mergeConfigs process. An attacker can obtain sensitive REST datasource authentication credentials by modifying the config.url to redirect requests to an attacker-controlled endpoint, which results in the server including preserved authorization headers in outbound requests.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the /api/public/v1/roles/assign endpoint, which fails to properly restrict assignment of global privileges. An attacker can gain unauthorized global administrative access by sending crafted requests that escalate their own or other users' privileges. This is only exploitable if the tenant has an Enterprise license with the EXPANDED_PUBLIC_API feature enabled.

A fix was pushed into the master branch but not yet published.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the fetchToken function, which performs outbound HTTP requests without proper blacklist checks. An attacker can access internal services, exfiltrate sensitive data such as cloud metadata or credentials, and perform network reconnaissance by supplying a crafted OAuth2 token URL that points to internal or attacker-controlled endpoints.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Incorrect Authorization through the row action trigger process. An attacker can gain unauthorized access to data and perform actions on database rows outside their permitted scope by supplying a rowId that is not validated against the view's filters.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Arbitrary Code Injection via the calculation parameter in the V1 Views API, which is interpolated directly into a CouchDB reduce function without validation. An attacker can execute arbitrary JavaScript code within the CouchDB JavaScript engine by submitting a crafted value for calculation in a POST request to the affected endpoint. This allows access to document data and persistence of malicious code in the database design document.

Note:

This is only exploitable if the attacker has Builder role permissions.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the _req function. An attacker can access internal services and sensitive cloud metadata by leveraging HTTP redirects through an attacker-controlled server, bypassing IP blacklist protections.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the processUrlFile function. An attacker can access internal network resources and sensitive cloud metadata by supplying crafted URLs that target internal or private IP addresses, bypassing IP blacklist validation.

Upgrade @budibase/server to version 3.34.8 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Missing Authorization via the PUT /api/datasources/:datasourceId route. An attacker can overwrite datasource connection parameters such as host, port, and url by sending crafted requests, which may allow probing or interacting with internal services, exposing sensitive information, or disrupting application functionality for all users.

Upgrade @budibase/server to version 3.38.1 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the urlUpload function. An attacker can access internal network resources and sensitive metadata by submitting a crafted URL containing .tar.gz that bypasses insufficient validation, leading the server to make requests to arbitrary endpoints. This can be exploited by users with low privileges through the /api/plugin endpoint, potentially exposing confidential information from internal services or cloud metadata endpoints.

Note:

This is only exploitable if plugin loading is enabled and, for full internal network access, if the blacklist is disabled or bypassed.

Upgrade @budibase/server to version 3.35.10 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Command Injection via the bash automation step, which executes user-supplied input using execSync without proper sanitization or validation. An attacker can execute arbitrary system commands by crafting malicious input that is processed and interpolated, leading to remote code execution and potential full system compromise.

Upgrade @budibase/server to version 3.33.4 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Command Injection via the public webhook endpoint. An attacker can execute arbitrary commands as the root user within the application container and exfiltrate sensitive environment secrets by sending crafted HTTP POST requests to the unauthenticated webhook endpoint, provided an administrator has previously configured an automation with a Bash step that uses webhook trigger field templates.

Note: This is only exploitable if an admin has created and published an automation containing both a webhook trigger and a Bash step with a template referencing trigger fields, and the deployment is self-hosted (SELF_HOSTED=1).

Upgrade @budibase/server to version 3.33.4 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Directory Traversal via the fileUpload() and the createTempFolder() function. An attacker can delete arbitrary directories and write files to any location accessible by the Node.js process by uploading a crafted tarball with a filename containing path traversal sequences in a multipart request.

Note: This is only exploitable if the attacker has Global Builder privileges.

Upgrade @budibase/server to version 3.33.4 or higher.

@budibase/server is a Budibase Web Server

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the preview() in the REST datasource query endpoint, which allows user-supplied URLs in the fields.path parameter to be requested by the server without validation. An attacker can access internal network resources, cloud metadata endpoints, and sensitive internal services by supplying arbitrary URLs.

Note: This is only exploitable if the attacker is an authenticated admin or builder user.

Upgrade @budibase/server to version 3.34.8 or higher.