GHSA-QQF5-X7MJ-V43P高危已审查

budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

OSV 1.4.0 · github-reviewed · 修改于 2026-06-19 01:24

发布时间

2026-06-19 01:24

GitHub 审查时间

2026-06-19 01:24

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-qqf5-x7mj-v43p/GHSA-qqf5-x7mj-v43p.json

公告说明

Summary

This advisory covers three distinct SQL Injection vulnerabilities within Budibase's database connectors (PostgreSQL, Microsoft SQL Server, and MySQL). Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or parameterization during database introspection, an authenticated administrator can break out of string delimiters. This allows for arbitrary DDL/DML execution, database compromise, and potential underlying OS command execution (e.g., via MS SQL xp_cmdshell).

Details

Vulnerability Type & Title

PostgreSQL SET search_path SQL Injection

Description & Root Cause

The schema datasource config field is interpolated directly into a raw SQL statement without proper escaping. Double quotes inside the schema name are not escaped, allowing an attacker to break out of the string literal and inject arbitrary SQL.

Vulnerable Code: File: packages/server/src/integrations/postgres.ts, lines 355–358

const search_path = this.config.schema
  .split(",")
  .map(item => `"${item.trim()}"`)                // NO escaping of embedded "
await this.client.query(`SET search_path TO ${search_path.join(",")};`)

node-postgres sends this via the simple query protocol, which supports multi-statement execution with semicolons.

Step-by-Step Reproduction

Edit a PostgreSQL datasource configuration.
Set the schema field to: public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --
Save or trigger a connection test.
The query executes as: SET search_path TO "public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --;
PostgreSQL executes both statements.

Impact

Full database compromise. The attacker can read pg_shadow hashes, call pg_read_file(), or execute any DDL/DML.

Vulnerability Type & Title

标识信息

别名 / CVE

无

CWE

CWE-89

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-qqf5-x7mj-v43p",
  "aliases": [],
  "details": "### Summary\nThis advisory covers three distinct SQL Injection vulnerabilities within Budibase's database connectors (PostgreSQL, Microsoft SQL Server, and MySQL). Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or parameterization during database introspection, an authenticated administrator can break out of string delimiters. This allows for arbitrary DDL/DML execution, database compromise, and potential underlying OS command execution (e.g., via MS SQL `xp_cmdshell`).\n\n### Details\n\n### Vulnerability Type & Title\n**PostgreSQL `SET search_path` SQL Injection**\n\n### Description & Root Cause\nThe `schema` datasource config field is interpolated directly into a raw SQL statement without proper escaping. Double quotes inside the schema name are not escaped, allowing an attacker to break out of the string literal and inject arbitrary SQL.\n\n**Vulnerable Code:**\n**File:** `packages/server/src/integrations/postgres.ts`, lines 355–358\n\n```typescript\nconst search_path = this.config.schema\n  .split(\",\")\n  .map(item => `\"${item.trim()}\"`)                // NO escaping of embedded \"\nawait this.client.query(`SET search_path TO ${search_path.join(\",\")};`)\n```\n\n`node-postgres` sends this via the **simple query protocol**, which supports multi-statement execution with semicolons.\n\n### Step-by-Step Reproduction\n1. Edit a PostgreSQL datasource configuration.\n2. Set the schema field to:\n   `public\"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --`\n3. Save or trigger a connection test.\n4. The query executes as:\n   `SET search_path TO \"public\"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --;`\n5. PostgreSQL executes both statements.\n\n### Impact\n- Full database compromise. The attacker can read `pg_shadow` hashes, call `pg_read_file()`, or execute any DDL/DML.\n\n---\n\n### Vulnerability Type & Title\n**Microsoft SQL Server Schema Introspection SQL Injection**\n\n### Description & Root Cause\nThree methods used during schema introspection (`buildSchema`) interpolate user-controlled values directly into SQL strings using single-quote delimiters with no escaping.\n\n**Vulnerable Code:**\n**File:** `packages/server/src/integrations/microsoftSqlServer.ts`, lines 388–414\n\n```typescript\ngetDefinitionSQL(tableName: string, schemaName: string) {\n  return `select * from INFORMATION_SCHEMA.COLUMNS\n          where TABLE_NAME='${tableName}' AND TABLE_SCHEMA='${schemaName}'`\n}\n```\n\n`schemaName` comes directly from `this.config.schema` (user config).\n\n### Step-by-Step Reproduction\n1. Edit an MS SQL Server datasource configuration.\n2. Set the schema field to: `dbo'; EXEC xp_cmdshell('whoami'); --`\n3. Trigger schema introspection (fetch tables).\n4. The OS command executes on the SQL server if `xp_cmdshell` is enabled.\n\n### Impact\n- Arbitrary SQL execution, potentially leading to OS command execution via `xp_cmdshell`.\n\n---\n\n### Vulnerability Type & Title\n**MySQL `multipleStatements: true` + `DESCRIBE` Backtick Injection**\n\n### Description & Root Cause\nThe MySQL integration enables `multipleStatements: true`, allowing semicolon-separated multi-statement execution. When introspecting tables, table names are interpolated into a `DESCRIBE` query wrapped in backticks, but the backticks are not escaped.\n\n**Vulnerable Code:**\n**File:** `packages/server/src/integrations/mysql.ts`, lines 172, 305\n\n```typescript\nthis.config = { ...config, multipleStatements: true, ... }  // line 172\n...\n{ sql: `DESCRIBE \\`${tableName}\\`;` }  // line 305 — backtick NOT escaped\n```\n\n### Step-by-Step Reproduction\n1. An attacker (or malicious database user) creates a table named ``foo`; DROP TABLE users; --``.\n2. In Budibase, an admin triggers schema introspection for the database.\n3. Budibase reads the malicious table name from `INFORMATION_SCHEMA.TABLES` and inserts it into the `DESCRIBE` query.\n4. The backtick breaks out, and the secondary `DROP TABLE` payload executes.\n\n### Impact\n- Arbitrary SQL execution triggered during schema discovery. Requires prior database catalog manipulation.",
  "summary": "budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.39.19"
            }
          ]
        }
      ],
      "package": {
        "name": "budibase",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-06-18T17:24:47Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"
    }
  ],
  "published": "2026-06-18T17:24:47Z",
  "references": [
    {
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p",
      "type": "WEB"
    },
    {
      "url": "https://github.com/Budibase/budibase",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-18T17:24:47Z"
  }
}