GHSA-qw6m-8fw2-2v64

Summary

Budibase's MongoDB query execution endpoint (POST /api/v2/queries/:queryId) is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext() function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the result with JSON.parse(). An attacker can inject JSON metacharacters (", {, }) into parameter values to alter the structure of MongoDB queries, bypassing intended filters to read, modify, or delete arbitrary documents.

Details

The vulnerability exists because input validation and interpolation are misaligned. The validateQueryInputs() function blocks Handlebars template syntax ({{}}) but does not sanitize JSON structural characters:

packages/server/src/api/controllers/query/index.ts:57-69

function validateQueryInputs(parameters: QueryEventParameters) {
  for (let entry of Object.entries(parameters)) {
    const [key, value] = entry
    if (typeof value !== "string") {
      continue
    }
    if (findHBSBlocks(value).length !== 0) {
      throw new Error(
        `Parameter '${key}' input contains a handlebars binding - this is not allowed.`
      )
    }
  }
}

After validation passes, enrichContext() performs raw string interpolation with escaping explicitly disabled:

packages/server/src/sdk/workspace/queries/queries.ts:105-108

enrichedQuery[key] = processStringSync(fields[key], parameters, {
  noEscaping: true,
  noHelpers: true,
  escapeNewlines: true,
})

The interpolated string is then parsed as JSON at line 122:

packages/server/src/sdk/workspace/queries/queries.ts:122

enrichedQuery.json = JSON.parse(
  enrichedQuery.json ||
  enrichedQuery.customData ||
  enrichedQuery.requestBody
)

The parsed object flows directly into MongoDB driver calls with no further sanitization:

packages/server/src/integrations/mongodb.ts:509

return await...