CyberRota Analysis
AI-GeneratedBudibase Server versions prior to 3.41.3 are vulnerable to a server-side request forgery (SSRF) flaw in the datasource verify endpoint, which allows builder-level users to submit arbitrary URLs without proper validation. This vulnerability can be exploited by attackers to leak internal CouchDB credentials, potentially granting them full access to databases in cloud environments. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure and access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gaining full database access in cloud deployments.