Server: Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
Affects @budibase/serverSource GCVE Database
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@budibase/server | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, restrict query write permissions to trusted users only and avoid exposing the vulnerable query execution endpoint to untrusted users. Review and sanitize all user-supplied parameters to prevent injection of JSON metacharacters. Implement strict schema validation on the request body to reject malicious inputs. Monitor vendor communications for official patches or updates addressing this vulnerability.
Description
Budibase server versions up to 3.38.1 contain a NoSQL injection vulnerability in the MongoDB query execution endpoint POST /api/v2/queries/:queryId. The vulnerability arises from unsafe interpolation of user-supplied parameters into JSON query templates without proper escaping or sanitization of JSON structural characters. This allows authenticated app users with query write permissions to manipulate query filters, enabling unauthorized reading, modification, or deletion of arbitrary MongoDB documents. The endpoint lacks strict schema validation and restricts only Handlebars syntax but not JSON metacharacters, facilitating injection attacks.
Impact
An attacker with authenticated access as a regular app user and query write permissions can exploit this vulnerability to bypass intended query filters. This enables unauthorized data exfiltration by reading all documents in a MongoDB collection, including sensitive user or tenant data. Additionally, attackers can perform bulk modifications or deletions of documents by injecting broadened filters into updateMany or deleteMany queries. This can lead to significant data loss or unauthorized data manipulation within the affected Budibase instance.
Summary
Budibase's MongoDB query execution endpoint is vulnerable to NoSQL injection due to unsafe interpolation of user parameters into JSON query templates using Handlebars with escaping disabled. The validateQueryInputs() function blocks Handlebars bindings but does not sanitize JSON structural characters such as quotes or braces. This allows attackers to inject JSON metacharacters into parameters, altering the structure of MongoDB queries after JSON.parse(), bypassing intended filters. The resulting manipulated queries are executed directly against MongoDB collections, enabling attackers with query write permissions to read, modify, or delete arbitrary documents. The endpoint requires only PermissionType.QUERY with PermissionLevel.WRITE, accessible to regular app users, and does not enforce Joi schema validation on the request body, increasing risk.
Weaknesses
References
- github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64 (opens in a new tab)
- github.com/Budibase/budibase/pull/18907 (opens in a new tab)
- github.com/Budibase/budibase/commit/2d6c1d17cff8a653adbb2f9003eda9de38c7670f (opens in a new tab)
- github.com/Budibase/budibase (opens in a new tab)
- github.com/Budibase/budibase/releases/tag/3.39.9 (opens in a new tab)