CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.40.0 are vulnerable to a NoSQL injection in the MongoDB datasource integration, allowing attackers to manipulate user-supplied parameters and bypass access controls. This vulnerability can lead to unauthorized document access, execution of arbitrary JavaScript, and unauthorized modifications to collections. Organizations using Budibase with MongoDB should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.