GHSA-4g2x-vq5p-5vj6: @budibase/server Budibase Affected By VM2 Constructor Vulnerability
CRITICALGHSA-4g2x-vq5p-5vj6 is a CRITICAL (CVSS 9.8) budibase affected by vm2 constructor vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting @budibase/server libraries in the npm ecosystem. The issue involves budibase affected by vm2 constructor escape vulnerability. Remediation is available by upgrading affected packages to version 2.20.0.
GHSA-4g2x-vq5p-5vj6 at a Glance
Security Impact
CVSS: 9.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to Fix GHSA-4g2x-vq5p-5vj6
To remediate this vulnerability, upgrade all affected @budibase/server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @budibase/server@2.20.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @budibase/serverHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-4g2x-vq5p-5vj6, inspect your project dependencies using npm:
npm ls @budibase/serverAnalyze the terminal output to locate any version of @budibase/server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.20.0), your application is affected.
Note: The npm ls @budibase/server command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In @budibase/server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-4g2x-vq5p-5vj6 Affected @budibase/server Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@budibase/server
|
npm |
< 2.20.0
|
2.20.0
|
References
Frequently Asked Questions
What is GHSA-4g2x-vq5p-5vj6?
Which @budibase/server versions are affected?
What version fixes GHSA-4g2x-vq5p-5vj6?
Is @budibase/server affected?
What is the CVSS score of GHSA-4g2x-vq5p-5vj6?
What CWE is associated with GHSA-4g2x-vq5p-5vj6?
How can I check npm dependencies for GHSA-4g2x-vq5p-5vj6?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4g2x-vq5p-5vj6",
"modified" : "2024-08-15T17:02:27Z",
"published" : "2024-03-01T20:09:00Z",
"aliases" : [ ],
"summary" : "Budibase affected by VM2 Constructor Escape Vulnerability",
"details" : "### Impact\nPreviously, budibase used a library called `vm2` for code execution inside the Budibase builder and apps, such as the UI below for configuring bindings in the design section.\n\n\n\nDue to a [vulnerability in vm2](https://github.com/advisories/GHSA-cchq-frgv-rjh5), any environment that executed the code server side (automations and column formulas) was susceptible to this vulnerability, allowing users to escape the sandbox provided by `vm2`, and to expose server side variables such as `process.env`. It's recommended by the authors of `vm2` themselves that you should move to another solution for remote JS execution due to this vulnerability.\n\n### Patches\nWe moved our entire JS sandbox infrastructure over to `isolated-vm`, a much more secure and recommended library for remote code execution in 2.20.0. This also comes with a performance benefit in the way we cache and execute your JS server side. The budibase cloud platform has been patched already and is not running `vm2`, but self host users will need to manage the updates by themselves.\n\nIf you are a self hosted user, you can take the following steps to reproduce the exploit and to verify if your installation is currently affected.\n\nCreate a new formula column on one of your tables in the data section with the following configuration.\n\n\nAdd the following JS function to the formula and save.\n\n\nIf your installation is vulnerable, when the formula evaluates you will be able to see the printed `process.env` in your new formula field. If not, your installation is not affected.\n\n### Workarounds\nThere is no workaround at this time for any budibase app that uses JS. You must fully migrate post version 2.20.0 to patch the vulnerability.\n\n### References\n- https://github.com/advisories/GHSA-cchq-frgv-rjh5\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@budibase/server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.20.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Budibase/budibase/security/advisories/GHSA-4g2x-vq5p-5vj6"
}, {
"type" : "WEB",
"url" : "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5"
}, {
"type" : "WEB",
"url" : "https://github.com/Budibase/budibase/commit/601c02a4acc695b1cc602bf611f0ae66d6e5868f"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Budibase/budibase"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-94" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2024-03-01T20:09:00Z",
"nvd_published_at" : null
}
}