Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
An attacker sends an HTTP request to a public webhook endpoint in Budibase, triggering a configured automation containing a Bash step. The lack of an authentication mechanism for this endpoint means that anyone with network access can execute the automation. The executed Bash code runs in the context of the root user inside the container, classifying the vulnerability as command injection (CWE-78). This allows the attacker to achieve complete takeover of the container environment.
An attacker can execute arbitrary system commands with root privileges inside the Budibase container, enabling complete takeover of the environment, data theft, application modification, or further lateral movement in the network.
Budibase must be immediately updated to version 3.33.4, in which the vulnerability has been patched. The patch is available in the vendor's references and in the official GitHub repository (commit f0c731b409a96e401445a6a6030d2994ff4ac256).
Budibase in versions prior to 3.33.4 (all instances with publicly accessible webhook endpoints and automations containing Bash steps).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HBudibase
APPBudibase< 3.33.4
Related vulnerabilities
Budibase: path traversal przez symlink w endpoint przetwarzania ZIP
SQL/NoSQL Injection w Budibase — nieautoryzowany odczyt i zapis danych
Budibase: pominięcie uwierzytelnienia przez manipulację query string
SSRF w Budibase — nieaktywna ochrona blacklisty IP umożliwia dowolne żądania
Path Traversal w Budibase — odczyt dowolnych plików przez endpoint PWA ZIP