Budibase OpenAPI Import Path Traversal Vulnerability

Executive Summary

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator. This allows authenticated builders to embed file:// references in OpenAPI specifications submitted to the import endpoint. When processed, these references cause the server to read and return arbitrary local files, including sensitive files like environment variables containing secrets such as JWT keys, API keys, and database credentials.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Budibase server version is below 3.45.0. Use the command: curl -s http://your-budibase-server/api/version | grep version. If the version is less than 3.45.0, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker with builder access can read sensitive local files on the server, including environment variables containing secrets like JWT secrets, API keys, and database credentials. This can lead to privilege escalation, session token forgery, and full compromise of the Budibase deployment. Attackers can also read files like /etc/passwd or /proc/self/environ.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. Exposure of personal data, credentials, or secrets can result in regulatory penalties, loss of trust, and legal consequences due to non-compliance with data security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Budibase to version 3.45.0 or later. If upgrading is not possible, restrict access to the /api/queries/import/info endpoint to trusted users only and disable OpenAPI import functionality until patched.

Useful 0 Not Useful 0