{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cwe-200/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["npm/@budibase/server \u003c= 3.38.1","Budibase Worker service"],"_cs_severities":["high"],"_cs_tags":["budibase","vulnerability","file-read","information-disclosure","cloud","mongodb","api","web-vulnerability","cwe-200"],"_cs_type":"advisory","_cs_vendors":["Budibase"],"content_html":"\u003cp\u003eA high-severity vulnerability (GHSA-ppr4-5f46-j9c6) has been identified in Budibase, a low-code platform, specifically affecting versions of \u003ccode\u003enpm/@budibase/server\u003c/code\u003e up to and including \u003ccode\u003e3.38.1\u003c/code\u003e. This flaw allows an authenticated attacker with \u0026quot;builder\u0026quot; privileges to exploit the MongoDB datasource configuration. When configuring a new MongoDB datasource, the \u003ccode\u003etlsCertificateKeyFile\u003c/code\u003e and \u003ccode\u003etlsCAFile\u003c/code\u003e fields are passed directly to the MongoDB driver as server-side file paths without proper validation or confinement. By crafting a POST request to the \u003ccode\u003e/api/datasources/verify\u003c/code\u003e endpoint, an attacker can supply arbitrary absolute paths (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e) within these fields. The server's differential error responses (a \u0026quot;PEM routines\u0026quot; error for existing, readable files versus an \u0026quot;ENOENT\u0026quot; error for non-existent files) create an arbitrary-path existence and read oracle across the entire server filesystem, including multi-tenant cloud environments. This enables malicious actors to discover sensitive system files and potentially exfiltrate the content of certificate-related files.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker with builder role accesses the Budibase application.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious POST request to the \u003ccode\u003e/api/datasources/verify\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request body includes a MongoDB datasource configuration where the \u003ccode\u003econfig.tlsCertificateKeyFile\u003c/code\u003e or \u003ccode\u003econfig.tlsCAFile\u003c/code\u003e parameter is set to an absolute path on the server's filesystem, such as \u003ccode\u003e/etc/passwd\u003c/code\u003e or \u003ccode\u003e/root/.ssh/id_rsa\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Budibase server processes this request, passing the attacker-controlled absolute path directly to the underlying MongoDB driver for certificate verification.\u003c/li\u003e\n\u003cli\u003eThe MongoDB driver attempts to access the specified file on the server's filesystem.\u003c/li\u003e\n\u003cli\u003eBased on the filesystem's response, Budibase returns a distinct error message: a \u0026quot;PEM routines::no start line\u0026quot; error if the file exists and is readable but not a valid PEM certificate, or an \u0026quot;ENOENT: no such file or directory, open '\u0026lt;path\u0026gt;'\u0026quot; error if the file does not exist.\u003c/li\u003e\n\u003cli\u003eThe attacker analyzes the returned error message to determine the existence and readability of arbitrary files, effectively using the endpoint as an information oracle.\u003c/li\u003e\n\u003cli\u003eIf the targeted file is a certificate or PEM file, the attacker can configure the MongoDB connection string to an attacker-controlled server using mutual TLS, potentially leading to the exfiltration of the file's content.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability grants an authenticated attacker the ability to perform arbitrary-path existence and read oracle operations across the entire filesystem of the underlying multi-tenant cloud server. This allows for the discovery of sensitive server configuration files, secrets, and potentially the paths of other tenants. While not directly leading to remote code execution, the ability to confirm the existence and read parts of sensitive files like \u003ccode\u003e/etc/passwd\u003c/code\u003e or certificate files poses a significant information disclosure risk. In multi-tenant environments, this could lead to lateral movement or further compromise by exposing critical system details or credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch \u003ccode\u003enpm/@budibase/server\u003c/code\u003e\u003c/strong\u003e: Immediately upgrade \u003ccode\u003enpm/@budibase/server\u003c/code\u003e to a version greater than \u003ccode\u003e3.38.1\u003c/code\u003e to apply the vendor's recommended fixes.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement input validation and confinement\u003c/strong\u003e: Ensure that \u003ccode\u003etlsCertificateKeyFile\u003c/code\u003e and \u003ccode\u003etlsCAFile\u003c/code\u003e fields are disallowed as filesystem paths on managed/Cloud instances, or that any file references are confined to an allow-listed certificates directory and absolute/\u003ccode\u003e..\u003c/code\u003e paths are rejected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable web application logging\u003c/strong\u003e: Review web server logs for POST requests to \u003ccode\u003e/api/datasources/verify\u003c/code\u003e that contain unexpected or absolute file paths in the request body, specifically within \u003ccode\u003etlsCertificateKeyFile\u003c/code\u003e or \u003ccode\u003etlsCAFile\u003c/code\u003e parameters.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy SSRF protection\u003c/strong\u003e: Ensure that the MongoDB connection host is routed through an SSRF blacklist to prevent potential further exploitation paths, as recommended by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:29:19Z","date_published":"2026-07-24T21:21:32Z","id":"https://feed.craftedsignal.io/briefs/2026-07-budibase-file-oracle/","summary":"A vulnerability in Budibase's MongoDB datasource configuration allows authenticated attackers to specify arbitrary absolute server-side file paths for `tlsCertificateKeyFile` and `tlsCAFile`, enabling the `/api/datasources/verify` endpoint to act as an arbitrary-path existence/read oracle on the underlying multi-tenant server, distinguishing between existing and non-existing files and potentially exfiltrating certificate content.","title":"Budibase MongoDB Datasource Vulnerability Allows Server Filesystem Existence/Read Oracle","url":"https://feed.craftedsignal.io/briefs/2026-07-budibase-file-oracle/"}],"language":"en","title":"CraftedSignal Threat Feed - Cwe-200","version":"https://jsonfeed.org/version/1.1"}