CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.38.1 are vulnerable to a server-side request forgery (SSRF) due to inadequate validation of HTTP redirects in the REST datasource integration. This flaw allows attackers with Builder role access to configure a REST datasource that can redirect to internal IP addresses, potentially exposing sensitive cloud metadata and internal services. Organizations using Budibase should prioritize patching to mitigate the risk of unauthorized access to internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.