@budibase/backend-core@3.29.0

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Improper Authentication in the OIDC SSO authentication process. An attacker can gain unauthorized access to an existing user account, including accounts with administrative privileges, by authenticating through a trusted identity provider that asserts the victim's email address without verifying it. This is only exploitable if the attacker can authenticate through an identity provider trusted by the application and configure it to assert the victim's email with the verification flag set to false.

Upgrade @budibase/backend-core to version 3.39.30 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch protections.

Upgrade @budibase/backend-core to version 3.39.30 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access internal-only services, read sensitive data, or modify and delete internal resources by configuring a REST datasource to use a rebinding hostname that resolves to a safe public IP during validation but to an internal IP at connection time. This allows the attacker to make the server issue arbitrary HTTP requests to internal endpoints, potentially leading to credential theft, data exposure, or service disruption. This is only exploitable if the attacker has an authenticated account with permissions to configure or run a REST datasource.

Upgrade @budibase/backend-core to version 3.39.30 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the buildMatcherRegex and matches functions. An attacker can perform unauthorized state-changing actions on behalf of authenticated users by injecting specific route patterns into the query string, causing security middleware to skip critical validation steps.

Upgrade @budibase/backend-core to version 3.35.10 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the outboundFetch process. An attacker can access internal network resources and retrieve sensitive information by exploiting DNS rebinding during outbound HTTP requests. This allows the attacker to bypass blacklist validation and connect to internal services, potentially exposing internal metadata and credentials.

Upgrade @budibase/backend-core to version 3.39.15 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the POST /api/public/v1/roles/unassign endpoint. Users can retain their privileges up to one hour after bulk unassignment due to improper Redis user cache synchronisation with CouchDB.

Upgrade @budibase/backend-core to version 3.38.2 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the _req function. An attacker can access internal services and sensitive cloud metadata by leveraging HTTP redirects through an attacker-controlled server, bypassing IP blacklist protections.

Upgrade @budibase/backend-core to version 3.38.1 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the urlUpload function. An attacker can access internal network resources and sensitive metadata by submitting a crafted URL containing .tar.gz that bypasses insufficient validation, leading the server to make requests to arbitrary endpoints. This can be exploited by users with low privileges through the /api/plugin endpoint, potentially exposing confidential information from internal services or cloud metadata endpoints.

Note:

This is only exploitable if plugin loading is enabled and, for full internal network access, if the blacklist is disabled or bypassed.

Upgrade @budibase/backend-core to version 3.35.10 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Sensitive Cookie Without "HttpOnly" Flag via the set function in the cookie handling process. An attacker can gain unauthorized access to user accounts and exfiltrate authentication tokens by executing malicious JavaScript in the victim's browser, which can read the session cookie due to missing security flags.

Upgrade @budibase/backend-core to version 3.35.10 or higher.

@budibase/backend-core is a Budibase backend core libraries used in server and worker

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the authenticated middleware, which uses unanchored regular expressions to match public endpoint patterns against the full request URL, including the query string. An attacker can gain unauthorized access to protected endpoints by appending a public endpoint path as a query parameter, thereby bypassing authentication checks and accessing sensitive user and system information.

Upgrade @budibase/backend-core to version 3.35.10 or higher.