https://feed.craftedsignal.io/cpes/cpe2.3abudibasebudibase/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 03 Jul 2026 11:21:33 +0000https://feed.craftedsignal.io/briefs/2026-07-budibase-nosql-injection/Fri, 03 Jul 2026 11:21:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-budibase-nosql-injection/An unauthenticated attacker can exploit CVE-2026-54350, a NoSQL operator injection vulnerability in Budibase server versions prior to 3.39.12, by injecting malicious parameters into public-facing query templates, enabling them to bypass intended query filters, read all documents including sensitive information, and modify all documents within affected collections with a single HTTP request.A critical NoSQL operator injection vulnerability, tracked as CVE-2026-54350, affects Budibase server versions up to 3.39.0 (and npm package @budibase/server versions < 3.39.12). This flaw stems from improper input validation and handling within the enrichContext and validateQueryInputs functions when processing query templates for MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body datasources. An unauthenticated attacker can craft a malicious JSON payload in a parameter value that contains specific JSON metacharacters. When this payload is substituted into a raw JSON query body and subsequently parsed, it can overwrite the intended query logic, such as a {name: "..."} filter being replaced by {name: {$exists: true}}. This allows the attacker to read and modify entire database collections, including sensitive data, using a single HTTP request to a publicly accessible API endpoint, without requiring authentication or bypassing CSRF protections.

Attack Chain

1. An attacker identifies a published Budibase application that uses a non-SQL datasource (MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body) and has a PUBLIC role assigned to at least one query (e.g., GetUserByName).
2. The attacker, unauthenticated, sends an HTTP POST request to /api/v2/queries/:queryId for the identified public read query, including an x-budibase-app-id header.
3. The request body contains a JSON payload with the parameters field where a parameter (e.g., name) is injected with a crafted string like x",\"name\":{\"$exists\":true},\"$comment\":\"audit".
4. Budibase's enrichContext function substitutes this raw parameter value directly into the query's JSON body string without proper JSON-string escaping.
5. The subsequent JSON.parse operation on the malformed string results in a parsed filter object (e.g., collection.find()) where the attacker's injected $exists:true clause overrides the legitimate filter, effectively widening the scope to return all documents.
6. The Budibase server returns all documents from the collection, including sensitive fields not intended for public exposure (e.g., password_hash, secret), to the unauthenticated attacker.
7. If a PUBLIC write query (e.g., updateMany) is available, the attacker can similarly inject a payload to widen the filter scope, causing the updateMany operation to affect all documents in the collection, leading to widespread data modification or destruction.

Impact

Successful exploitation of CVE-2026-54350 allows an unauthenticated visitor to conduct broad data breaches and integrity compromises. This includes the anonymous reading of every document within any MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection exposed via a PUBLIC query. Attackers can exfiltrate sensitive data such as password_hash, secret, api_token, and mfa_secret from columns not intended to be returned. Furthermore, where a PUBLIC update, delete, or aggregate query exists, attackers can anonymously modify or destroy every document in that collection, extending beyond the original builder's intended single-document scope. All of this can be achieved with a single HTTP request, bypassing session and CSRF protections.

Recommendation

• Patch CVE-2026-54350 immediately: Upgrade your Budibase server instances to version 3.39.12 or newer to remediate the vulnerability. Refer to the official Budibase release notes and patching guidance.
• Deploy the provided Sigma rule: Implement the Detect CVE-2026-54350 Exploitation Sigma rule in your SIEM to identify attempts at NoSQL operator injection against your Budibase applications.
• Monitor webserver logs: Specifically look for POST requests to /api/v2/queries/:queryId containing JSON body parameters with suspicious injection patterns (e.g., ",\\\"$exists\\\":true") in cs-uri-query or equivalent fields.
• Audit public queries: Review all PUBLIC role-assigned queries in your Budibase applications, especially those interacting with MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body datasources, to ensure sensitive data is not inadvertently exposed or modifiable.

]]>criticaladvisorynosql-injectionweb-vulnerabilitybudibasedata-exfiltrationdata-manipulationcritical-vulnerabilityapi-exploitationhttps://feed.craftedsignal.io/briefs/2026-07-budibase-arbitrary-file-read/Fri, 03 Jul 2026 11:01:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-budibase-arbitrary-file-read/A critical vulnerability, CVE-2026-54352, in Budibase server allows an authenticated workspace builder to perform arbitrary file reads on the host system by uploading a crafted PWA zip file containing a symbolic link, leading to credential compromise and privilege escalation, potentially enabling a full global administrator takeover.A critical arbitrary file read vulnerability (CVE-2026-54352) affects Budibase server versions up to 3.39.0 (HEAD feab995, released 2026-05-20). This flaw allows an authenticated workspace builder to read any file accessible by the server process, including highly sensitive configuration files like /data/.env (containing JWT_SECRET, INTERNAL_API_KEY, and database credentials) and system files such as /etc/passwd or /etc/shadow. The vulnerability stems from improper handling of symbolic links within uploaded PWA .zip files by the extract-zip@2.0.1 library, coupled with insufficient validation in Budibase's icon processing logic. When exploited, it can lead to credential disclosure, privilege escalation to global administrator, and even cross-tenant exposure in multi-tenant environments. This vulnerability impacts self-hosted Budibase deployments, especially those running the default Docker image where the Node server executes as root.

Attack Chain

1. An attacker gains authenticated access as a workspace builder to a Budibase instance, obtaining necessary cookies and CSRF tokens from GET /api/global/self.
2. The attacker crafts a .zip archive containing a symbolic link, for example, evil.png, which targets a sensitive file on the server's filesystem, such as /data/.env.
3. The attacker includes an icons.json file within the .zip that references the created symbolic link, for example, {"icons":[{"src":"evil.png", ...}]}.
4. The attacker sends an HTTP POST request to /api/pwa/process-zip with the crafted .zip file in the request body, using their authenticated session.
5. The Budibase server, using extract-zip@2.0.1, extracts the .zip file into a temporary directory, preserving the absolute target of the symbolic link.
6. During PWA icon processing, the server's validator (packages/server/src/api/controllers/static/index.ts:259-268) resolves the icon path, follows the symbolic link using fs.existsSync, and then opens the target file using fsp.open to stream its content.
7. The content of the sensitive target file (e.g., /data/.env) is then streamed into MinIO and made available via a new public URL, typically GET /api/assets/{appId}/pwa/{uuid}.png.
8. The attacker retrieves the sensitive file's content by making a GET request to the newly generated PWA asset URL, completing the arbitrary file read.

Impact

Successful exploitation of CVE-2026-54352 leads to the disclosure of critical secrets from the Budibase server's host system. This includes JWT_SECRET, INTERNAL_API_KEY, MINIO_ACCESS_KEY, MINIO_SECRET_KEY, REDIS_PASSWORD, COUCHDB_PASSWORD, and DATABASE_URL from the /data/.env file. With the leaked JWT_SECRET, an attacker can forge HS256 JWTs, escalating privileges from a workspace builder to a global administrator. This allows for full compromise of the Budibase instance, including potential cross-tenant data access on multi-tenant installations. Furthermore, if the Budibase Docker container runs as root (the default configuration), system files like /etc/passwd and /etc/shadow are also exposed, providing additional credential harvesting opportunities.

Recommendation

• Immediately update Budibase server to version 3.39.9 or newer to patch CVE-2026-54352.
• Rotate all credentials found in /data/.env, including JWT_SECRET, INTERNAL_API_KEY, MINIO_*, REDIS_PASSWORD, COUCHDB_PASSWORD, and DATABASE_URL, especially if using self-hosted Budibase deployments.
• Implement strong logging and monitoring for attempts to access sensitive file paths mentioned in the IOCs (e.g., /data/.env, /etc/passwd, /etc/shadow) via unexpected application endpoints.
• Ensure that the Budibase server process does not run with root privileges within its container or host environment, following the principle of least privilege, to limit the blast radius of arbitrary file read vulnerabilities.

]]>criticaladvisoryarbitrary-file-readweb-vulnerabilityprivilege-escalationcredential-accesssymlinkbudibasecloudsaas