Budibase PostgreSQL Integration Command Injection Vulnerability

A command injection vulnerability has been identified in the PostgreSQL integration of Budibase, a low-code platform for internal tools. This issue exists in versions through 3.23.22. The vulnerability arises because the integration constructs shell commands using user-controlled database connection values, such as the database name, host, and password, without proper sanitization. As a result, an attacker could inject malicious commands that are executed on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Budibase is running, potentially leading to a complete system compromise and unauthorized access to sensitive data.

Reproduction

To reproduce this vulnerability, upload a PostgreSQL datasource in Budibase Cloud with a malicious payload in the password or database name fields. Then, export the external schema of the datasource.

Remediation

Users can update to Budibase version 3.23.35, where this vulnerability has been fixed.