Compliance Impact

This vulnerability allows authenticated BASIC users to retrieve unmasked Snowflake private keys in plaintext, potentially leading to unauthorized access to sensitive data stored in Snowflake analytics warehouses.

Such unauthorized access to sensitive data could result in violations of data protection regulations and standards like GDPR and HIPAA, which mandate strict controls over access to confidential information and require protection of sensitive data.

Therefore, exploitation of this vulnerability could compromise compliance with these regulations by exposing sensitive credentials and data to unauthorized parties.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Budibase, an open-source low-code platform, prior to version 3.38.3. The issue is that the function removeSecrets only masks datasource configuration fields typed as PASSWORD, but it does not mask fields typed as SENSITIVE_LONGFORM. Specifically, the Snowflake integration's privateKey field is typed as SENSITIVE_LONGFORM, so it is not masked by the filter.

As a result, an authenticated BASIC user with any app role can call the GET /api/datasources/:datasourceId endpoint, which is supposed to be protected by certain permissions, and receive the full Snowflake private key (PEM) in plaintext.

This vulnerability was fixed in Budibase version 3.38.3.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive credentials, specifically the Snowflake private key used for integration. An attacker with basic authentication and any app role can retrieve this private key in plaintext.

Exposure of the private key can allow attackers to impersonate the legitimate user or system, potentially gaining unauthorized access to Snowflake data sources, leading to data breaches or unauthorized data manipulation.

The CVSS base score of 7.7 indicates a high severity impact, with confidentiality being highly affected.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Budibase to version 3.38.3 or later, where the issue with the removeSecrets function masking sensitive fields properly is fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Budibase instance is running a version prior to 3.38.3 and if the /api/datasources/:datasourceId endpoint returns unmasked Snowflake private keys to authenticated BASIC users.

To detect exploitation attempts or presence of this vulnerability, you can monitor API calls to the /api/datasources/:datasourceId endpoint and verify if any authenticated BASIC user is able to retrieve sensitive private key data in plaintext.

Suggested commands include using network traffic inspection tools like curl or wget to simulate an authenticated BASIC user request to the endpoint, for example:

• curl -H "Authorization: Basic <base64-encoded-credentials>" https://<budibase-server>/api/datasources/<datasourceId>
• Check the response for unmasked private key data in the returned JSON.

Additionally, you can audit your Budibase version by running:

• budibase --version

If the version is earlier than 3.38.3, the system is vulnerable and should be updated.

Useful 0 Not Useful 0