Budibase SSRF via DNS rebinding in REST datasource integration

Executive brief

Budibase, a platform for building internal business applications, contains a vulnerability in how it handles REST data sources. An authenticated user can bypass security filters to make the Budibase server send requests to internal systems that should be off-limits. This could allow an attacker to steal sensitive cloud credentials, access internal databases, or modify private company data, potentially leading to a full compromise of the hosting environment.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Budibase's REST datasource integration due to a Time-of-Check Time-of-Use (TOCTOU) flaw during DNS resolution. While Budibase implements a 'fetchWithBlacklist' guard to pin hostnames to validated IPs using Node.js agents, the REST integration utilizes the 'undici' library, which ignores these agents in favor of its own dispatcher. An authenticated attacker can use a DNS rebinding domain to provide a safe IP during the initial validation and an internal IP (such as 127.0.0.1 or 169.254.169.254) during the actual connection. This allows for full-response SSRF, enabling the attacker to read cloud metadata, access internal databases like CouchDB or Redis, and perform unauthorized state-changing actions. The vulnerability is specific to the REST datasource path as other outbound sinks use the standard node-fetch transport which honors the security pins.

Affected products

• Budibase @budibase/server <= 3.38.1

Timeline

• 2026-07-22: disclosed: Initial disclosure date on GitHub Advisory Database
• 2026-07-24: advisory: Advisory updated

References

• https://api.github.com/users/dhairya7760
• https://github.com/dhairya7760
• https://api.github.com/users/dhairya7760/gists%7B/gist_id%7D
• https://api.github.com/users/dhairya7760/repos
• https://avatars.githubusercontent.com/u/56912333?v=4
• https://api.github.com/users/dhairya7760/events%7B/privacy%7D