CyberRota Analysis
AI-GeneratedThe Budibase backend-core is vulnerable due to the omission of the shared address space range 100.64.0.0/10 from its default SSRF blacklist, allowing authenticated users with Builder permissions to exploit this oversight. This can lead to unauthorized access to internal services by submitting REST datasource query previews, potentially exposing sensitive data. Organizations using Budibase in self-hosted environments should prioritize this issue and implement the recommended remediation by updating the blacklist to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLIST_IPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULT_BLACKLIST.