{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/npm/@budibase/server--3.38.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["npm/@budibase/server (\u003c= 3.38.1)"],"_cs_severities":["high"],"_cs_tags":["nosql-injection","rce","data-exfiltration","access-control-bypass","web-application"],"_cs_type":"advisory","_cs_vendors":["Budibase"],"content_html":"\u003cp\u003eA significant NoSQL injection vulnerability exists within Budibase's MongoDB datasource integration, affecting \u003ccode\u003enpm/@budibase/server\u003c/code\u003e versions up to and including 3.38.1. This flaw allows an authenticated low-privileged BASIC app user to bypass query-level access controls that are designed to scope MongoDB reads (e.g., \u003ccode\u003e{\u0026quot;email\u0026quot;: \u0026quot;{{ currentUser.email }}\u0026quot;}\u003c/code\u003e). The vulnerability stems from how Budibase enriches and parses JSON queries; the \u003ccode\u003enoEscaping: true\u003c/code\u003e option during Handlebars enrichment, combined with \u003ccode\u003eJSON.parse\u003c/code\u003e not rejecting duplicate keys, permits an attacker to inject MongoDB operators such as \u003ccode\u003e$ne\u003c/code\u003e or \u003ccode\u003e$comment\u003c/code\u003e into the query's JSON filter. This manipulation effectively rewrites the query sent to MongoDB, allowing the attacker to read all documents in a collection, potentially execute arbitrary JavaScript on the MongoDB server using the \u003ccode\u003e$where\u003c/code\u003e operator, perform cross-collection data access, or even arbitrarily update and delete documents. This vulnerability poses a critical risk to data confidentiality, integrity, and potentially the availability of sensitive information stored in MongoDB databases connected to Budibase applications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerable Configuration\u003c/strong\u003e: A Budibase builder configures a MongoDB datasource query (e.g., \u003ccode\u003efind-by-name\u003c/code\u003e) with a \u003ccode\u003ejson\u003c/code\u003e field containing a Handlebars binding like \u003ccode\u003e{\u0026quot;name\u0026quot;: \u0026quot;{{name}}\u0026quot;}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eApp Publication and User Assignment\u003c/strong\u003e: The builder publishes the application and assigns a BASIC user (e.g., Bob) a role with permissions to execute this query.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Query Execution\u003c/strong\u003e: The BASIC user, Bob, sends an HTTP POST request to the Budibase API endpoint \u003ccode\u003e/api/queries/:queryId\u003c/code\u003e with a crafted JSON payload in the request body.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHandlebars Enrichment and JSON Parsing\u003c/strong\u003e: Budibase's server component (\u003ccode\u003epackages/server/src/sdk/workspace/queries/queries.ts\u003c/code\u003e) processes the request. It enriches the query string using Handlebars with \u003ccode\u003enoEscaping: true\u003c/code\u003e and then \u003ccode\u003eJSON.parse\u003c/code\u003es the result.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eOperator Injection via Duplicate Key\u003c/strong\u003e: The crafted JSON payload (e.g., \u003ccode\u003e{\u0026quot;parameters\u0026quot;:{\u0026quot;name\u0026quot;:\u0026quot;x\\\u0026quot;, \\\u0026quot;name\\\u0026quot;: {\\\u0026quot;$ne\\\u0026quot;: \\\u0026quot;x\\\u0026quot;}, \\\u0026quot;$comment\\\u0026quot;: \\\u0026quot;bud-033\u0026quot;}}\u003c/code\u003e) exploits \u003ccode\u003eJSON.parse\u003c/code\u003e's behavior of keeping the last value for duplicate keys. This results in an object where a MongoDB operator (like \u003ccode\u003e$ne\u003c/code\u003e for 'not equal') replaces the intended simple value filter.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMongoDB Query Execution\u003c/strong\u003e: The modified filter, containing the injected MongoDB operator, reaches the \u003ccode\u003ecollection.find\u003c/code\u003e method in \u003ccode\u003epackages/server/src/integrations/mongodb.ts\u003c/code\u003e without proper sanitization.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAccess Control Bypass and Data Access\u003c/strong\u003e: MongoDB executes the query with the attacker-controlled operator, bypassing the builder's intended per-user access controls (e.g., \u003ccode\u003e{\u0026quot;email\u0026quot;: \u0026quot;{{ currentUser.email }}\u0026quot;}\u003c/code\u003e), allowing the user to retrieve all documents from the collection.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFurther Exploitation\u003c/strong\u003e: Depending on the specific operator injected, the attacker may achieve arbitrary JavaScript execution via \u003ccode\u003e$where\u003c/code\u003e (resulting in arbitrary data exfiltration or system commands on MongoDB server) or perform arbitrary updates/deletions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is the complete circumvention of per-user query filters established by Budibase application builders. A BASIC end-user, who should only see their own records, can read every document in the connected MongoDB collection. This could lead to a full collection dump, exposing other users' sensitive data, administrative records, or any confidential fields stored in the database. The severity escalates if the attacker utilizes specific MongoDB operators: the \u003ccode\u003e$where\u003c/code\u003e operator allows arbitrary JavaScript execution within the MongoDB server process, potentially leading to remote code execution and exfiltration of any field. The \u003ccode\u003e$lookup\u003c/code\u003e operator enables cross-collection joins within the same database, extending data access beyond the initially queried collection. Furthermore, if \u003ccode\u003eupdate\u003c/code\u003e or \u003ccode\u003edelete\u003c/code\u003e action types are exposed by the builder, the injected filter can be leveraged to wipe or rewrite every document the connection has access to, causing data integrity and availability issues. The blast radius is limited to the builder's own MongoDB deployment, affecting data the Budibase connection can reach.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch Immediately\u003c/strong\u003e: Upgrade Budibase \u003ccode\u003enpm/@budibase/server\u003c/code\u003e to a version greater than 3.38.1 to address the identified vulnerability. This is the most effective mitigation.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement WAF/API Gateway Protection\u003c/strong\u003e: Deploy a Web Application Firewall (WAF) or API Gateway in front of Budibase applications to inspect HTTP POST request bodies for suspicious NoSQL injection patterns, specifically targeting MongoDB operators like \u003ccode\u003e\u0026quot;$ne\u0026quot;\u003c/code\u003e, \u003ccode\u003e\u0026quot;$comment\u0026quot;\u003c/code\u003e, \u003ccode\u003e\u0026quot;$where\u0026quot;\u003c/code\u003e, or duplicate JSON keys within the \u003ccode\u003e/api/queries/:queryId\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable Application-Level Logging\u003c/strong\u003e: Ensure detailed application-level logging is enabled for Budibase API interactions, specifically capturing the full HTTP POST request bodies to the \u003ccode\u003e/api/queries\u003c/code\u003e endpoint. This allows for post-incident analysis and detection of attempted exploitation patterns not covered by network-level logs.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview MongoDB Security Configurations\u003c/strong\u003e: Restrict the permissions of the MongoDB user account used by Budibase to the absolute minimum necessary (principle of least privilege) to limit the impact of any successful injection. Avoid granting permissions that allow \u003ccode\u003e$where\u003c/code\u003e or \u003ccode\u003e$eval\u003c/code\u003e if not strictly required.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:44:27Z","date_published":"2026-07-24T21:44:27Z","id":"https://feed.craftedsignal.io/briefs/2026-07-budibase-nosql-injection/","summary":"A high-severity NoSQL injection vulnerability in Budibase's MongoDB datasource (npm/@budibase/server \u003c= 3.38.1) allows an authenticated BASIC app user to bypass query-level access controls, enabling full collection dumps, arbitrary JavaScript execution via the MongoDB `$where` operator, cross-collection pivots, and arbitrary update/delete operations due to improper handling of Handlebars-enriched JSON queries.","title":"Budibase MongoDB NoSQL Injection Vulnerability Allows Data Exfiltration and Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2026-07-budibase-nosql-injection/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Budibase (\u003c= 3.39.19)","npm/@budibase/server (\u003c= 3.38.1)"],"_cs_severities":["high"],"_cs_tags":["budibase","privilege-escalation","API-abuse","authorization-bypass","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Budibase"],"content_html":"\u003cp\u003eBudibase versions up to 3.39.19 are vulnerable to a high-severity privilege escalation flaw (GHSA-j9fc-w3mr-x6mv) allowing an app-scoped builder to gain unauthorized builder access to any other application within the tenant. This vulnerability, an an incomplete fix of a previous hardening attempt, stems from a missing authorization check in the \u003ccode\u003ePOST /api/public/v1/roles/assign\u003c/code\u003e API endpoint. Attackers can leverage their existing app-scoped builder privileges to self-assign elevated roles or cross-app builder access, leading to a tenant-wide compromise of app data and the potential for remote code execution via automation steps, as well as exfiltration of stored datasource credentials. The flaw impacts licensed Budibase deployments (Business/Enterprise) where \u003ccode\u003eisExpandedPublicApiEnabled\u003c/code\u003e is active.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, possessing an app-scoped builder role for \u003ccode\u003eappA\u003c/code\u003e but no global administrative privileges, initiates the attack.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates and sends a \u003ccode\u003ePOST\u003c/code\u003e request to the \u003ccode\u003e/api/global/self/api_key\u003c/code\u003e endpoint on the Budibase worker, successfully obtaining a public API key, as app-scoped builders have \u003ccode\u003ehasBuilderPermissions\u003c/code\u003e which passes the \u003ccode\u003ebuilderOnly\u003c/code\u003e middleware check.\u003c/li\u003e\n\u003cli\u003eUsing the newly acquired API key and their session cookie, the attacker sends a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/api/public/v1/roles/assign\u003c/code\u003e, setting the \u003ccode\u003ex-budibase-app-id\u003c/code\u003e header to \u003ccode\u003eappA\u003c/code\u003e (their controlled app ID) and including a JSON body specifying \u003ccode\u003e{\u0026quot;userIds\u0026quot;:[\u0026quot;\u0026lt;self\u0026gt;\u0026quot;],\u0026quot;appBuilder\u0026quot;:{\u0026quot;appId\u0026quot;:\u0026quot;\u0026lt;appB\u0026gt;\u0026quot;}}\u003c/code\u003e where \u003ccode\u003eappB\u003c/code\u003e is the target application.\u003c/li\u003e\n\u003cli\u003eThe API endpoint's \u003ccode\u003ebuilderOrAdmin\u003c/code\u003e middleware passes due to \u003ccode\u003eisBuilder(user, appA)\u003c/code\u003e, and the \u003ccode\u003evalidateGlobalRoleUpdate\u003c/code\u003e function (designed for global roles) ignores the \u003ccode\u003eappBuilder\u003c/code\u003e attribute, which was not referenced for validation.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esdk.publicApi.roles.assign\u003c/code\u003e function processes the request, adding \u003ccode\u003eappB\u003c/code\u003e to the attacker's \u003ccode\u003euser.builder.apps\u003c/code\u003e without performing any authorization checks that the caller controls \u003ccode\u003eappB\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully escalates privileges, becoming a builder for \u003ccode\u003eappB\u003c/code\u003e and potentially any other app within the tenant.\u003c/li\u003e\n\u003cli\u003eWith builder access to \u003ccode\u003eappB\u003c/code\u003e, the attacker can now read/modify all data rows, access and exfiltrate stored datasource credentials, and modify automations to achieve remote code execution via \u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003eexecuteScript\u003c/code\u003e, or \u003ccode\u003eexecuteQuery\u003c/code\u003e steps, leading to tenant-wide app/data-plane compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploitation of this vulnerability allows an app-scoped builder to bypass cross-app isolation, gaining builder access to all other applications within the licensed Budibase tenant. This enables the attacker to read and modify sensitive data, exfiltrate stored datasource credentials (e.g., database connection strings, API keys), and create or modify automation rules to execute arbitrary code on the server. The attacker can also assign any data-plane role, including \u003ccode\u003eADMIN\u003c/code\u003e, to themselves or any other user within any application. While it doesn't directly grant global \u003ccode\u003eadmin\u003c/code\u003e or \u003ccode\u003ebuilder\u003c/code\u003e flags, it effectively leads to a tenant-wide compromise of all app data and functionality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Budibase deployments to a patched version to remediate the missing authorization checks in the \u003ccode\u003ePOST /api/public/v1/roles/assign\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eImplement API gateway or WAF rules to inspect and validate requests to the \u003ccode\u003e/api/public/v1/roles/assign\u003c/code\u003e endpoint, specifically checking if the \u003ccode\u003eappId\u003c/code\u003e in the request body matches the \u003ccode\u003ex-budibase-app-id\u003c/code\u003e header for non-global administrators.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for unusual or excessive \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/api/global/self/api_key\u003c/code\u003e and \u003ccode\u003e/api/public/v1/roles/assign\u003c/code\u003e endpoints from non-global administrator accounts, which could indicate attempts to exploit this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:15:22Z","date_published":"2026-07-24T21:15:22Z","id":"https://feed.craftedsignal.io/briefs/2026-07-budibase-privilege-escalation/","summary":"An app-scoped builder in Budibase can exploit a missing authorization flaw in the public role assignment API (`POST /api/public/v1/roles/assign`) to escalate privileges, granting themselves builder access to any other application within the tenant, read/modify data, exfiltrate datasource credentials, and execute arbitrary code via automation steps, compromising the entire tenant's app and data plane in Budibase versions up to and including 3.39.19 and npm/@budibase/server up to 3.38.1.","title":"Budibase Privilege Escalation via Role Assignment API","url":"https://feed.craftedsignal.io/briefs/2026-07-budibase-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Npm/@Budibase/Server (\u003c= 3.38.1)","version":"https://jsonfeed.org/version/1.1"}