SQL Injection in Baserow Formula Function

Executive Summary

Baserow 2.3.3 has a SQL injection flaw in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can inject malicious SQL by using an undocumented fourth argument. This argument is treated as a SQL template and directly inserted into PostgreSQL queries without sanitization. When formula fields are recalculated, the injected SQL runs with the privileges of the Baserow PostgreSQL role, not the user's permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Baserow instances for formula fields using the index() function with four arguments. Check PostgreSQL logs for suspicious queries containing injected SQL patterns. Review user permissions for unauthorized admin access or data modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read sensitive data like usernames and password hashes from the auth_user table. They could also modify user permissions, including granting themselves administrator access. Exploitation occurs immediately upon saving a malicious formula field.

Useful 0 Not Useful 0

Compliance Impact

Baserow claims compliance with GDPR, HIPAA, and SOC 2 Type II, but this vulnerability could lead to unauthorized data access or modification, violating these standards. Unpatched systems risk non-compliance due to potential data breaches and unauthorized privilege escalation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Baserow to a patched version if available. Temporarily restrict low-privileged users from creating or modifying formula fields. Monitor database logs for unusual activity and revoke any unauthorized admin permissions granted during exploitation.

Useful 0 Not Useful 0