Executive brief
Budibase is a low-code platform that allows users to build applications with automated workflows and formula-based data transformations. The platform executed user-supplied JavaScript code in a sandboxed environment using the vm2 library. A flaw in vm2's promise handler allowed attackers to escape this sandbox and access sensitive server variables, potentially compromising the confidentiality and integrity of applications and their underlying infrastructure. The vulnerability affects all self-hosted Budibase deployments prior to version 2.20.0.
Technical details
The vulnerability stems from a promise handler sanitization bypass in vm2 versions up to 3.9.19, which allows sandbox escape through constructor exploitation. Budibase used vm2 to execute JavaScript in two server-side contexts: automations and column formulas. An attacker with the ability to create or modify formulas or automations could inject malicious code that bypasses vm2's sandbox restrictions, gaining access to Node.js global objects and server-side environment variables (process.env). The attack requires network access to the Budibase application and the ability to modify application logic (via formula columns or automation scripts), but does not require elevated privileges or user interaction beyond creating/editing these elements. The fix involved replacing vm2 with isolated-vm, a more secure sandbox library, in version 2.20.0. Cloud-hosted Budibase was already patched; self-hosted users must upgrade to 2.20.0 or later.
Affected products
- Budibase Budibase < 2.20.0
Timeline
- 2024-03-01: disclosed
- 2024-03-01: patched: Version 2.20.0 released with isolated-vm replacement