Security researchers recently publicized a report of an alleged vulnerability in Bubble that they claim allows running arbitrary queries against Elasticsearch databases.
We take our users’ data security very seriously, and want to correct its significant inaccuracies.
The most important aspect to clarify is that the technique described in this report does not allow unauthorized access to user data in any Bubble-created application that has properly configured privacy rules. As we state in our Documentation, as well as our educational materials, privacy rules are an essential part of your app’s security. Any database data that is private or sensitive needs to be protected with privacy rules to be considered secure. We offer a number of tools to help users properly secure their app, including our Flusk security suite, as well as in-editor warnings if users attempt to deploy an app without privacy rules configured.
We strongly urge all users concerned about this report to audit their privacy rules, including running Flusk on their applications, to ensure that they are properly protected. We want to be clear that any attempts to bypass properly configured privacy rules to access non-public data are prohibited by our Terms.
Bubble is built to host all different kinds of applications, which themselves host a range of public and private data. As explained in our security documentation, Bubble operates on a shared responsibility model: We provide the platform and tools, while application builders are responsible for implementing appropriate privacy rules for their specific use cases. It is not a platform vulnerability that data not secured by privacy rules is accessible, since many users deliberately host public data on our platform.
Another clarification: The technique described in this report does not allow arbitrary execution of Elasticsearch queries, as claimed. The security researchers have reverse-engineered the internal API we use to let Bubble-hosted webpages request data from our servers. This API is designed to be secure: It authenticates users and prevents accessing data that they ought not have access to as defined in the application’s privacy rules, and it properly transforms all queries to protect against injection attacks. In fact, this API is not even powered by Elasticsearch, so the claim that it allows arbitrary Elasticsearch queries has no basis in fact.
Like many modern websites, Bubble-built applications run large amounts of JavaScript code in user web browsers and communicate with their servers via APIs. Any JavaScript sent to the client, and any API calls made by the client, are inherently public, and reverse-engineerable. While we do not publish many of the implementation details of how Bubble apps work, we expect that anything in the web browser could be investigated by end users, and design our security posture accordingly.
If you have any concerns about building safely on Bubble, we are happy to help — please reach out to us and we can give you more guidance on the tools you can use to properly secure your application.
The Bubble Team
Important Update 1:30pm EDT
The original post was deleted by the author and they have posted this follow up:
Hello,
We’ve removed the post on the Bubble zero day. The purpose of the post was to draw attention to the issue — which was indeed addressed.
As a recap, 2 researchers published a paper on Bubble-dot-io and how to exploit it. Bubble ignored them. We were requested to relay the issue loudly so it was addressed. It was addressed. Bubble asserts they do not consider this an exploit because this is the result of users failing to RTM and follow the Bubble security guidelines.
I will personally take the L that it was a stretch to classify this as zero day when this is the result of users not following the Bubble best practices guide. It does not impact Bubble in totality.
