Path Traversal in Budibase via Symlink Exploitation

Executive Summary

This vulnerability exists in Budibase, an open-source low-code platform, prior to version 3.39.9. It involves the handling of uploaded .zip files via the POST /api/pwa/process-zip endpoint. The platform uses [email protected] to extract the .zip file into a temporary directory. However, [email protected] preserves absolute symbolic link (symlink) targets when restoring symlink entries.

The system validates icon paths listed in icons.json by resolving paths and checking if they start with the base directory, but it does not reject symbolic-link entries. When the server opens these paths, it follows the symlinks and streams the target file's bytes into MinIO, which then serves these bytes back via a GET request.

As a result, a workspace-level builder can read any file that the server process has permission to open, potentially exposing sensitive files through this symlink traversal and extraction flaw. This vulnerability is fixed in Budibase version 3.39.9.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Budibase server version is prior to 3.39.9 and if it allows uploading .zip files containing symbolic links that point outside the intended directory.

To detect exploitation attempts or presence of malicious symlinks, you can monitor uploads to the POST /api/pwa/process-zip endpoint and inspect the contents of uploaded .zip files for symlinks pointing to sensitive system files.

You can also check if the server process is running with elevated privileges (e.g., as root), which increases risk.

Suggested commands to help detect suspicious symlinks or files on your system include:

• Use 'find' to locate symbolic links in directories used by Budibase for uploads or temp extraction: find /path/to/budibase/temp -type l -ls
• Check the target of suspicious symlinks: ls -l /path/to/symlink
• Monitor network traffic for GET requests to /api/assets/{appId}/pwa/{uuid}.png which may indicate attempts to retrieve streamed files.
• Audit server logs for POST requests to /api/pwa/process-zip with unusual payload sizes or patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact because it allows an attacker with workspace-level builder access to read arbitrary files on the server that the server process can open. This can lead to unauthorized disclosure of sensitive information.

• Confidential data exposure by reading sensitive files.
• Potential compromise of system security by leaking configuration files, credentials, or other critical data.
• High severity impact as indicated by the CVSS score of 9.6, with high confidentiality and integrity impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized reading of sensitive files on the server, including secrets such as JWT_SECRET, INTERNAL_API_KEY, and database credentials. Exposure of such sensitive information can lead to data breaches and unauthorized access, which may violate data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive data.

Because the vulnerability enables privilege escalation and potential full system compromise, it increases the risk of unauthorized data disclosure and loss of data integrity, both of which are critical compliance concerns under these standards.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Budibase version 3.39.9. The immediate step to mitigate this vulnerability is to upgrade Budibase to version 3.39.9 or later.

Useful 0 Not Useful 0