Server: Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
Affects @budibase/serverSource GCVE Database
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@budibase/server | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available by restoring the authorization middleware to require BUILDER-level permissions on the affected endpoint. Additionally, the implementation should validate that the datasourceId belongs to the caller's app and enforce that the S3 bucket used for presigned URLs matches the configured datasource bucket, ignoring any caller-supplied bucket parameter.
Description
Budibase server version 3.39.4 contains an authorization regression in the S3 presigned URL upload endpoint. This flaw allows BASIC app users, who normally have limited permissions, to obtain S3 PutObject presigned URLs. The endpoint incorrectly uses TABLE/WRITE permission instead of the intended BUILDER level, and does not restrict the target S3 bucket to the configured datasource bucket, enabling uploads to any S3 bucket accessible by the stored IAM credentials.
Summary
In Budibase v3.39.4, the API route /api/attachments/:datasourceId/url was changed from requiring BUILDER-level authorization to TABLE/WRITE permission, which BASIC users possess by default. This regression allows BASIC users to generate presigned S3 PutObject URLs. Additionally, the controller accepts a bucket parameter from the request body without validating it against the datasource's configured bucket, permitting uploads to arbitrary S3 buckets within the IAM credential scope. The issue was confirmed by tests authenticating as BASIC users successfully obtaining signed URLs. The root cause is the lowered authorization requirement combined with lack of bucket validation.
Impact
An attacker with BASIC app user privileges can generate valid presigned S3 PutObject URLs and upload arbitrary content to any S3 bucket accessible by the IAM credentials stored in the application. This could lead to unauthorized data injection or modification in S3 buckets, potentially impacting data integrity and security. There is no direct confidentiality or availability impact reported.
Weaknesses
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.