Server-Side Request Forgery in Budibase Before 3.38.1

Executive Summary

Budibase before version 3.38.1 has a server-side request forgery (SSRF) vulnerability in its REST datasource integration. The flaw occurs because the system fails to validate HTTP redirects against an IP blacklist. Attackers with a Builder role can exploit this by setting up a REST datasource that points to an external server, which then redirects requests to internal IP addresses. This bypasses the blacklist protection, allowing access to cloud metadata endpoints and internal services.

Useful 0 Not Useful 0

Detection Guidance

Check Budibase server logs for unusual REST datasource requests or redirects to internal IP addresses. Monitor network traffic for outbound connections to internal IPs from Budibase processes. Review datasource configurations for external endpoints that may redirect to internal services.

Useful 0 Not Useful 0

Impact Analysis

If you are a Budibase user with Builder role, an attacker could exploit this to access internal services or cloud metadata, potentially leading to data breaches or unauthorized access to sensitive information. For users without Builder role, the risk is lower but still exists if an attacker gains elevated privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected Budibase versions may face legal and regulatory penalties if a breach occurs due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Budibase to version 3.38.1 or later. Disable or restrict REST datasource configurations with external endpoints. Implement strict IP whitelisting for internal services. Monitor and block suspicious redirect patterns in network traffic.

Useful 0 Not Useful 0