Buddibase Pre-Auth Arbitrary File Write via S3 Key Path Traversal

Vulnerability Overview Vulnerability Name: Arbitrary File Write via retrieveDirectory S3-Key Path Traversal Description: Buddibase uses an S3 key containing user-supplied filename components when writing user-controlled content to the APPS object store (e.g., AI knowledge file uploads, worker global configuration uploads). The helper function ( ) aims to neutralize dangerous path sequences, but it retains segments. The library only strips "unsafe" punctuation, preserving and (after ). Consequently, a builder can store an S3 key whose key literally contains traversal segments, such as . When the same workspace is later exported via (builder-gated), calls . lists every object under the workspace prefix, including the poisoned key, and writes each object's body to the local file system via , where . The in resolves the segments, causing the object body to be written to a path that escapes the . This is an authenticated builder -> arbitrary file write vulnerability, occurring during export, using attacker-controlled content. The target is constrained by to however many segments the key contains enough to reach , , , or any other location writable by the Buddibase process. Impact Scope Affected Versions: 3.40.0 Fixed Versions: 3.40.0 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVE ID: No known CVE Weaknesses: - CWE-02 - CWE-73 - CWE-1186 Credit: hypogoyen1209 Remediation Recommended Layered Fixes: 1. Patch to reject or collapse : - In , after the call, reject keys containing segments or strip them. - Apply this to each call site. 2. Add an inclusion assertion to : - Before , resolve the target path and assert that it is within . - This mimics the existing pattern in , which correctly protects plugin tarball extraction. 3. Pattern-validate AI knowledge file on upload: - In , reject any filename containing path separators or . Similarly, validate the worker global configuration parameter in (currently only ). 4. Replace with a maintained alternative: - The library is over 10 years old and unmaintained. The most defensive fix is including containment checks in , which eliminates the write primitive regardless of how the key is constructed. #1 and #3 together also close the injection-on-upload vector. POC Code Step-by-Step Exploitation 1. Authenticate as a builder in the target tenant. 2. Upload an AI knowledge file with a filename containing a traversal path: - The controller at reads , which is the traversal string. It passes this to -> (which preserves ). The object is stored. 3. Trigger an export for the same workspace: 4. -> : - Lists the poisoned key. The write loop calls , resolving to (or further with additional segments). The object body (the attacker-uploaded file content) is written. 5. The attacker has now written arbitrary content to the temp directory: - Depending on the target: -> cron executes the file as a cron job -> RCE. -> SSH login to the Buddibase user -> RCE. -> loaded by Node on the next request -> RCE. Any path monitored by a file watcher or cron -> RCE. Control-Time Runtime PoC reproduces the exact + write loop against the actual fixed library. Output: The file is written to (outside the simulated ) with attacker-controlled content.

Goal Reached Thanks to every supporter — we hit 100%!

Buddibase Pre-Auth Arbitrary File Write via S3 Key Path Traversal

More from this source