PT-2024-40070 · Budibase+2 · Budibase+2

Published 2024-03-01 · Updated 2024-03-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Budibase versions prior to 2.20.0

Description: The issue arises from a vulnerability in the vm2 library used for code execution inside the Budibase builder and apps. This vulnerability allows users to escape the sandbox provided by vm2 and expose server-side variables such as process.env. The authors of vm2 recommend moving to another solution for remote JS execution due to this vulnerability.

Recommendations: For Budibase versions prior to 2.20.0, update to version 2.20.0 or later, which migrates the JS sandbox infrastructure to isolated-vm, a more secure library for remote code execution. This update also provides a performance benefit in caching and executing JS server-side. Self-hosted users must manage these updates themselves, while the Budibase cloud platform has already been patched.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

GHSA-4G2X-VQ5P-5VJ6

Affected Products

Budibase

Isolated-Vm

Vm2

References · 5

• https://osv.dev/vulnerability/GHSA-4g2x-vq5p-5vj6 · Vendor Advisory
• https://github.com/Budibase/budibase · Note
• https://github.com/Budibase/budibase/security/advisories/GHSA-4g2x-vq5p-5vj6 · Note
• https://github.com/Budibase/budibase/commit/601c02a4acc695b1cc602bf611f0ae66d6e5868f · Note
• https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 · Note