Budibase Stored XSS in Text Component: BASIC Users Execute JS via Markdown CSP Bypass

Vulnerability Overview Title: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN=srcdoc CSP bypass Description: Software: Budibase/budibase Affected Versions: <3.39.0 Fixed Version: None Severity: 8.1 / 10 Summary: The Budibase Text component directly renders Markdown to using without employing any sanitizer. Any BASIC user with WRITE permissions can create Markdown content containing malicious HTML on a table, thereby executing JavaScript within an administrator's session. Details: Sink: Attacker Model: - Alice: Account Owner / Global Administrator - Bob: BASIC user with WRITE permissions - Alice's application contains a table with a long-text column, to which Bob can submit malicious Markdown content. Variant A: Cloud, strict CSP (verified on lwnyub5k.budibase.app) CloudFront distributes Budibase's static JS. The CSP allows . Bob uploads a file, distributed via CloudFront, which is allowed by the CSP. Bob submits Markdown content containing , triggering XSS. Variant B: Self-hosted, same-origin attachment (verified on Budibase 3.35.8) In self-hosted instances, attachments are served via Nginx. The CSP allows . Bob uploads an file, served via Nginx, which is allowed by the CSP. Bob submits Markdown content containing , triggering XSS. Proof of Concept: Shared App Setup (Alice, the admin): 1. Create an application, add a table named with a (long text) column. 2. On the table's Roles table, grant BASIC users READ + WRITE permissions. 3. On the screen, add a Data Provider bound to , a Repeater bound to the Data Provider, and a Text component bound to the Repeater's field, formatted as Markdown. 4. Publish the application. 5. Add a user and invite Bob as a BASIC user. Variant A: Budibase Cloud (live, lwnyub5k.budibase.app): Bob uploads a file, distributed via CloudFront, which is allowed by the CSP. Bob submits Markdown content containing , triggering XSS. Variant B: self-hosted 3.35.8: Bob uploads an file, served via Nginx, which is allowed by the CSP. Bob submits Markdown content containing , triggering XSS. Impact Scope Self-hosted: Any BASIC user with WRITE permissions can upload HTML files to any table and trigger XSS via the Markdown component. Cloud: Attachments are distributed via CloudFront, which is allowed by the CSP. Any BASIC user with WRITE permissions can upload HTML files to any table and trigger XSS via the Markdown component. Remediation 1. Sanitize the markdown output before : Use DOMPurify to whitelist-filter the Markdown output. 2. Serve user-uploaded attachments with : Set the header at the CDN or during upload to force the browser to download the attachment instead of rendering it. 3. Stop sharing the script CDN with user content: Separate the CloudFront distribution from user content to prevent the CSP from allowing user content as a script source. 4. Complementary: Set on the session cookie: Prevent JavaScript from accessing the session cookie. --- POC Code Variant A: Budibase Cloud (live, lwnyub5k.budibase.app) Variant B: self-hosted 3.35.8

Goal Reached Thanks to every supporter — we hit 100%!

Budibase Stored XSS in Text Component: BASIC Users Execute JS via Markdown CSP Bypass

More from this source