GHSA-rvhr-26g4-p2r8: Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
SummaryA critical unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. **This vulnerability ONLY affects Budibase Cloud (SaaS)** - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization.The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with **secrets baked into its environment variables**, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable.DetailsRoot CauseFile: `packages/server/src/db/inMemoryView.ts:28`**Why Only Cloud is Vulnerable:**File: `packages/server/src/sdk/workspace/rows/search/internal/internal.ts:194-221`The `view.map` parameter comes directly from user input when creating table views with filters. The code constructs a string by concatenating `"fn = "` with the user-controlled map function and passes it to `eval()`, allowing arbitrary JavaScript execution in the Node.js server context.**Self-hosted deployments are not affected** because they use native CouchDB design documents instead of the in-memory eval() path.Attack FlowAuthenticated user creates a table view with custom filterFrontend sends POST request to `/api/views` with malicious payload in filter valueBackend stores view configuration in CouchDBWhen view is queried (GET `/api/views/{viewName}`), `runView()` is calledMalicious code is `eval()`'d on server - RCE achievedExploitation VectorThe vulnerability is triggered via the view filter mechanism. When creating a view with a filter condition, the filter value can be injected with JavaScript code that breaks out of the intended expression context:**Malicious filter value:**This payload:Closes the expected string context with `x"`Uses `||` (OR operator) to inject arbitrary codeReturns `true` to make the filter always matchCloses with `|| ""` to maintain valid syntaxVerified on ProductionTested on own Budibase Cloud account (y4ylfy7m.budibase.app,) to confirm severity. Testing was deliberately limited - no customer data was retained and exploitation was stopped once impact was confirmed:Achieved RCE on `app-service` pod (hostname: `app-service-5f4f6d796d-p6dhz`, Kubernetes, `eu-west-1`)Extracted `process.env` - confirmed presence of platform secrets (`JWT_SECRET`, `INTERNAL_API_KEY`, `COUCH_DB_URL`, `MINIO_ACCESS_KEY`, etc.)Used extracted `COUCH_DB_URL` credentials to verify CouchDB access - enumerated database list (489,827 databases) to confirm scale of impactQueried users table to confirm data is readable (retrieved email addresses)Uploaded an HTML file as a PoC artifact to confirm write access.Proof of ConceptPoC ScriptVideo Demohttps://github.com/user-attachments/assets/cd12e1ab-02fd-4d0d-9fb5-d78bb83cdf99Reproduction Steps**Prerequisites:**Create free Budibase Cloud account at https://budibase.appCreate a new appCreate a table with at least one text field**Exploitation:**Copy the PoC script aboveReplace placeholders with your tenant URL, app ID, table IDGet your JWT token from browser cookies (`budibase:auth`)Create a webhook at https://webhook.site for exfiltrationRun the script: `python3 budibase_rce_poc.py`**Verification:**Check webhook.site - you'll receive all server environment variablesExtracted data includes JWT_SECRET, INTERNAL_API_KEY, database credentialsAdditional NoteThe `budibase:auth` session cookie has `Domain=.budibase.app` (leading dot = all subdomains) and no `HttpOnly` flag, making it readable by JavaScript. Since the RCE allows uploading arbitrary HTML files to any subdomain (as demonstrated with the PoC artifact), an attacker could serve an XSS payload from their own tenant subdomain and steal session cookies from any Budibase Cloud user who visits that page (one click ATO).Responsible Disclosure StatementThis vulnerability was discovered during independent security research. Testing was conducted on a personal free-tier account only. Exploitation was deliberately limited to what was necessary to confirm the vulnerability and its impact:No customer data was accessed beyond enumerating database names and confirming that user records (email addresses) are readableThe PoC HTML file uploaded to confirm write access is benignThis report is being submitted directly to Budibase security with no plans for public disclosure until a fix is in place**Before any public disclosure, this report must be redacted/simplified** - all credentials, hostnames, internal API keys, tenant IDs, and other sensitive platform details included here for Budibase's remediation purposes must be removed or redacted
CVSS v3.1: 9.9