Remote Code Execution via Malicious Plugin Upload in Budibase

Budibase versions prior to 3.41.3 contain a critical remote code execution (RCE) vulnerability related to how the application handles plugin uploads. An authenticated user with administrator privileges can upload a specifically crafted plugin tarball containing malicious JavaScript code. The application's backend improperly handles these plugin files by invoking the JavaScript contents through the eval() function within the primary Node.js process. Because this process lacks sandboxing, the arbitrary code runs with the full privileges of the Budibase service. This vulnerability poses a severe risk to internal infrastructure, as attackers can leverage the execution context to exfiltrate sensitive environment variables, access database credentials, and potentially gain further persistence within the server environment.

Impact

Successful exploitation allows an authenticated administrator to achieve full remote code execution on the underlying server. This enables the complete compromise of the Budibase installation, potential access to linked data sources, and the exfiltration of sensitive configuration secrets, such as API keys and database credentials stored in environment variables.

Recommendation

• Upgrade all Budibase instances to version 3.41.3 or later immediately to patch the insecure plugin handling mechanism.
• Audit logs for administrative user activity, specifically monitoring for plugin upload events or modifications to the plugin directory.
• Review access control policies for the Budibase platform to ensure that the administrative role is restricted to trusted personnel only.
• Implement network segmentation for the Budibase server to limit the potential blast radius if the application process is compromised.