CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.40.0 are vulnerable due to an authorization regression in the S3 attachment upload endpoint, allowing BASIC users to obtain presigned URLs for S3 PutObject requests. This flaw enables unauthorized file uploads to any accessible S3 bucket, posing a significant risk of data exfiltration or manipulation. Organizations using affected versions should prioritize remediation to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.