GHSA-qw6m-8fw2-2v64: Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint (POST /api/v2/queries/:queryId) is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext() function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the result with JSON.parse(). An attacker can inject JSON metacharacters (", {, }) into parameter values to alter the structure of MongoDB queries, bypassing intended filters to read, modify, or delete arbitrary documents. Details The vulnerability exists because input validation and interpolation are misaligned. The validateQueryInputs() function blocks Handlebars template syntax ({{}}) but does not sanitize JSON structural characters: packages/server/src/api/controllers/query/index.ts:57-69 function validateQueryInputs(parameters: QueryEventParameters) { for (let entry of Object.entries(parameters)) { const [key, value] = entry if (typeof value !== "string") { continue } if (findHBSBlocks(value).length !== 0) { throw new Error( Parameter '${key}' input contains a handlebars binding - this is not allowed. ) } } } After validation passes, enrichContext() performs raw string interpolation with escaping explicitly disabled: packages/server/src/sdk/workspace/queries/queries.ts:105-108 enrichedQuery[key] = processStringSync(fields[key], parameters, { noEscaping: true, noHelpers: true, escapeNewlines: true, }) The interpolated string is then parsed as JSON at line 122: packages/server/src/sdk/workspace/queries/queries.ts:122 enrichedQuery.json = JSON.parse( enrichedQuery.json || enrichedQuery.customData || enrichedQuery.requestBody ) The parsed object flows directly into MongoDB driver calls with no further sanitization: packages/server/src/integrations/mongodb.ts:509 return await collection.find(json).toArray() packages/server/src/integrations/mongodb.ts:624 return await collection.deleteMany(json.filter, json.options) Consider a saved query with a JSON template li