Budibase - Admin Installer Installation Page Exposure Scanner

Budibase is a low-code platform used by developers and organizations to build internal tools quickly and efficiently. It's commonly deployed on servers to enable rapid application development and is utilized by companies looking to streamline their digital processes. The software allows for the creation of web applications that can access and manipulate data from various sources. Budibase provides a convenient platform for building and managing tools without extensive coding expertise. Its usability makes it a popular choice among IT teams trying to automate and simplify workflow processes. It is widely used in environments where rapid prototyping and application deployment are crucial for business operations.

The identified vulnerability in the Budibase - Admin Installer pertains to the exposure of the admin setup checklist endpoint. This exposure allows unauthorized users to potentially complete the setup process without authentication. If unmitigated, it provides attackers a pathway to gain full platform control by completing the setup as an administrator. This exposure serves as a significant threat to the integrity of the application as it bypasses the proper authentication mechanisms. It's a form of Security Misconfiguration where private endpoints are left accessible from the public network. The vulnerability underscores the importance of securing installation and configuration interfaces from unauthorized access.

Technical details of this vulnerability involve the publicly accessible checklist endpoint located at '{{BaseURL}}/api/global/configs/checklist'. When accessed, it returns a HTTP status code of 200 and contains the content type "application/json" as well as the header "X-Budibase-Tenant-Id". The response body includes indicators like "\"adminUser\":{\"checked\":false", suggesting the admin setup has not been completed. This indicates the endpoint is exposed and unprotected, inviting potential unauthorized setup actions. The vulnerability is rooted in the absence of authentication checks at the setup phase, allowing attackers to complete the administrative configuration of the platform by themselves.

Exploiting this vulnerability can lead to critical security breaches where malicious individuals could gain unauthorized administrative control over the Budibase platform. This exposes the application to numerous risks, including unauthorized data access, modification, or even deletion. In a production environment, such access could undermine trust in the platform and result in significant data breaches. Unauthorized setup completion could also allow the attacker to implant persistent backdoors within the application logic. The broader impact includes potential business disruption, loss of sensitive information, and damage to the company's reputation.

REFERENCES

• https://github.com/Budibase/budibase