NoSQL Injection in Budibase MongoDB Query Execution

Budibase Server versions before 3.40.0 contain a critical NoSQL injection vulnerability in the MongoDB query execution endpoint. The vulnerability stems from unsanitized interpolation of user-supplied parameters directly into JSON query templates, allowing attackers with query write permissions to inject JSON metacharacters and fundamentally alter MongoDB queries. This affects organizations using Budibase for data management and application development, particularly those exposing query functionality to users or integrating Budibase in multi-tenant environments where privilege boundaries exist. The CVSS 8.3 rating reflects the high severity due to potential unauthorized data access, modification, and deletion across arbitrary documents in connected MongoDB instances.

While this CVE lacks direct MITRE ATT&CK technique mappings, Casky's security skills leverage Claude AI's extended reasoning to detect the underlying attack patterns associated with NoSQL injection: T1190 (Exploit Public-Facing Application) during the initial injection phase, T1021 (Remote Services) if attackers gain elevated MongoDB access, and T1040 (Network Sniffing) if authentication credentials are exposed through query manipulation. Practitioners using Casky would observe detection findings focused on anomalous MongoDB query structures, unexpected JSON character sequences in application logs, unusual data access patterns deviating from baseline query templates, and authentication anomalies suggesting privilege escalation attempts. The platform's mapping to CWE-943 (Improper Neutralization of Structural Elements in Data Query Logic) helps practitioners understand the root cause and correlate similar injection vulnerabilities across their technology stack.