Attack Chain

1. Attacker identifies a public-facing Budibase application utilizing the vulnerable MySQL integration.
2. Attacker crafts a malicious SQL injection payload designed to execute multiple statements.
3. The crafted payload is inserted into a user-controlled input field within the Budibase application (e.g., a search box, login form, or data entry field).
4. The Budibase backend processes the user input, which is then passed directly to the MySQL client configured with multipleStatements: true.
5. The MySQL database server executes all statements within the crafted payload, including the legitimate application query and the attacker's malicious commands.
6. Malicious commands execute, leading to potential data exfiltration (e.g., SELECT INTO OUTFILE), data modification/destruction (e.g., DROP TABLE, DELETE), or privilege escalation (e.g., GRANT ALL PRIVILEGES).
7. The attacker achieves complete control over the application's underlying database, leading to data compromise.

Impact

The successful exploitation of this SQL injection vulnerability grants attackers complete control over the Budibase application's underlying MySQL database. This can result in significant damage, including the total destruction of data through DROP TABLE or DELETE commands, widespread data theft via SELECT INTO OUTFILE, and the ability to escalate database privileges. Furthermore, attackers can cause denial of service by disrupting database operations, rendering the application unusable. All data stored within the compromised database is at risk, potentially affecting a wide range of sensitive business information and user data.

Recommendation

• Upgrade Budibase Server to a version patched against GHSA-q6x4-v3qx-85qw (greater than 3.38.1) immediately to remediate the multipleStatements: true misconfiguration.
• Temporarily disable the MySQL integration within Budibase if immediate patching is not feasible, referencing the 'Remediation' section of the source advisory.
• Implement or strengthen a Web Application Firewall (WAF) to detect and block SQL injection patterns in HTTP request parameters, leveraging webserver log sources.
• Review and restrict the database user privileges for the Budibase application to the absolute minimum necessary functions, limiting the potential impact of future injection vulnerabilities.