Server: Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Affects @budibase/serverSource GCVE Database
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@budibase/server | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, avoid creating or allowing untrusted users to create tables with malicious names in the MySQL database used by Budibase. Administrators should exercise caution when performing schema introspection on databases with potentially untrusted table names. Monitor vendor channels for an official patch or update addressing this issue.
Description
Budibase server versions up to 3.38.1 contain a SQL injection vulnerability in the MySQL integration. The vulnerability arises because table names retrieved from INFORMATION_SCHEMA.TABLES are interpolated into DESCRIBE queries wrapped in backticks without escaping embedded backticks. Since the connection enables multipleStatements, an attacker can inject additional SQL statements by creating a maliciously named table. This allows arbitrary SQL execution during routine schema introspection triggered by an administrator.
Impact
An attacker with the ability to create tables in the MySQL database can execute arbitrary SQL commands during schema introspection by an administrator. This can lead to data loss, data corruption, or other high-impact consequences due to arbitrary SQL execution. The vulnerability affects confidentiality, integrity, and availability of the database. It requires the attacker to have some database privileges to create tables but does not require direct control over Budibase configuration.
Summary
The Budibase server's MySQL integration enables multipleStatements on the database connection, allowing execution of multiple semicolon-separated SQL statements in one query. During schema introspection, table names from INFORMATION_SCHEMA.TABLES are used in DESCRIBE queries with backticks, but embedded backticks in table names are not escaped. An attacker who can create tables in the MySQL database can name a table with embedded backticks and malicious SQL, causing the DESCRIBE query to break out of the identifier context and execute attacker-controlled SQL statements. This vulnerability enables arbitrary SQL execution triggered during normal schema discovery operations by an administrator, without requiring direct control of the Budibase datasource configuration.
Weaknesses
References
- github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2 (opens in a new tab)
- github.com/Budibase/budibase/pull/18989 (opens in a new tab)
- github.com/Budibase/budibase/commit/2c61f389c9986c91ddd8ae161c2b5e8ec21c60ac (opens in a new tab)
- github.com/Budibase/budibase (opens in a new tab)
- github.com/Budibase/budibase/releases/tag/3.39.18 (opens in a new tab)