Unauthenticated S3 URL Generation in Budibase

Executive Summary

This vulnerability affects Budibase, an open-source low-code platform, prior to version 3.39.0. An anonymous attacker who knows or can guess a workspace ID and an S3-source datasource ID can call a specific endpoint without authentication to obtain a 15-minute pre-signed PUT URL. This URL is minted using the victim's IAM identity, allowing the attacker to upload files to any S3 bucket that the victim's IAM credentials have write access to, not just the bucket configured for the datasource.

The vulnerable endpoint is POST /api/attachments/:datasourceId/url, which is protected only by recaptcha middleware but lacks proper authorization checks. The attacker also receives the public URL where the uploaded file will be accessible. Because the bucket is attacker-controlled, this allows the attacker to write arbitrary data to any bucket accessible by the victim's IAM credentials.

The vulnerability arises because the server does not restrict the bucket parameter to the configured datasource bucket and allows anonymous requests, enabling exploitation by non-browser clients. This issue was fixed in Budibase version 3.39.0.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated POST request to the Budibase server endpoint /api/attachments/:datasourceId/url that returns a pre-signed AWS S3 PUT URL. Detection can focus on identifying such unauthenticated requests to this endpoint, especially those that include workspace ids (app_...) and datasource ids (ds_...).

To detect exploitation attempts on your network or system, you can monitor HTTP POST requests to the /api/attachments/ endpoint that lack authentication headers but include suspicious workspace or datasource identifiers.

Example commands to detect such activity using common tools:

• Using tcpdump to capture HTTP POST requests to the vulnerable endpoint: tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep -i 'POST /api/attachments/'
• Using grep on web server logs to find unauthenticated POST requests to the endpoint: grep 'POST /api/attachments/' /var/log/nginx/access.log | grep -v 'Authorization'
• Using curl to test if the endpoint is accessible without authentication by sending a POST request with example workspace and datasource ids: curl -X POST https://your-budibase-server/api/attachments/ds_example/url -d '{"appId":"app_example"}' -H 'Content-Type: application/json'

Monitoring for unexpected pre-signed URL generation or unusual S3 PUT operations using AWS CloudTrail or S3 access logs can also help detect exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts. An attacker can upload arbitrary files to any S3 bucket that the victim's IAM credentials can write to, potentially leading to unauthorized data modification, data injection, or storage of malicious content.

Because the attacker obtains a pre-signed URL with the victim's IAM identity, this could lead to privilege escalation or abuse of the victim's AWS resources. It may also result in data integrity issues, unauthorized resource usage, or exposure of sensitive data if the uploaded content is accessible publicly.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Budibase version 3.39.0. Immediate mitigation involves upgrading Budibase to version 3.39.0 or later.

Since the vulnerability allows anonymous attackers to obtain pre-signed PUT URLs without authentication, restricting access to the affected endpoint or adding proper authorization middleware before the upgrade can help mitigate the risk temporarily.

Useful 0 Not Useful 0