Omkarparth

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.33.4 **Description** The bash automation step executes user-provided commands using the `execSync()` function without proper sanitization or validation. User input is processed through the `processStringSync()` function, which allows template interpolation. This flaw enables an attacker with permissions to create or modify automations to inject malicious shell commands, potentially leading to remote code execution, complete system compromise, data exfiltration, and lateral movement within the infrastructure. **Recommendations** Update to version 3.33.4. As a temporary workaround, disable the bash automation step in production. Implement a whitelist of allowed commands. Use parameterized command execution with proper escaping. Implement command argument validation. Use a restricted shell or command sandboxing. Add rate limiting and monitoring for command execution.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.23.22 **Description** Budibase is a low code platform that allows users to create internal tools, workflows, and admin panels. The PostgreSQL integration within Budibase constructs shell commands using user-controlled configuration values, such as the database name, host, and password, without adequate sanitization. Specifically, the password and other connection parameters are directly interpolated into a shell command within the `packages/server/src/integrations/postgres.ts` file (lines 529-531). An attacker who can control these database configuration values can inject shell commands. For example, manipulating the `password` or `database name` parameters could allow for arbitrary code execution, system compromise, and data exfiltration. The vulnerable code constructs a shell command using template literals, directly embedding the `this.config.password` value into the `PGPASSWORD` environment variable. **Recommendations** Versions prior to 3.23.22 should be updated. Use environment variables for sensitive values instead of command-line arguments. Validate and sanitize all configuration values. Use proper escaping for shell arguments. Consider using a PostgreSQL library's native dump functionality instead of shell commands. Use `execFile` with proper argument handling, as shown in the example fix, to avoid shell injection.