Mass Assignment in Budibase Webhook Trigger

Executive Summary

This vulnerability exists in Budibase, an open-source low-code platform, prior to version 3.39.9. The webhook trigger endpoint is publicly accessible and accepts the full HTTP request body as parameters for automation execution. Due to a mass assignment vulnerability in the externalTrigger() function, an attacker can overwrite the internal appId property by including it in the webhook POST body.

When the automation is processed asynchronously (which is the default for webhooks without a collect step), the worker executes the attacker-defined automation within the victim's workspace context. This grants the attacker full read and write access to the victim's database.

This vulnerability is fixed in Budibase version 3.39.9.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can gain full read and write access to your Budibase workspace database. This means they can view, modify, or delete data stored within your application.

Because the attacker can execute automation in the context of your workspace, they could potentially manipulate workflows, inject malicious data, or disrupt normal operations.

The CVSS score of 8.2 indicates a high severity, meaning the impact on confidentiality and integrity is significant, though availability is not affected.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Budibase to version 3.39.9 or later, where the issue has been fixed.

Useful 0 Not Useful 0