Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution — @budibase / server
Server-Side Request Forgery (SSRF)Impact
A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer.
The first path is OpenAPI query import. It validates the supplied hostname with the blacklist and then performs a separate raw fetch. A hostname that resolves to a public address during validation and to 127.0.0.1 during the request is accepted.
The second path is REST datasource/query execution. It calls the fixed fetchWithBlacklist() helper, but provides a custom undici fetchFn that installs a dispatcher. The helper passes a pinned Node agent, but undici uses the dispatcher and resolves the original hostname again at connection time. This defeats the DNS pinning added for the previous outbound fetch advisory.
Impact is authenticated SSRF from the Budibase server process. An attacker with the relevant builder/query privileges can reach loopback or private HTTP services that should be blocked by Budibase's outbound fetch protections, subject to the normal response handling of each feature.
Reproduction
- Configure an attacker-controlled hostname so the validation lookup returns a public IP address and the later request lookup returns an internal address such as
127.0.0.1. - Start a loopback canary HTTP service on the Budibase host.
- For OpenAPI query import, submit an import URL such as
http://rebind.test:<port>/openapi.jsonthrough the builder query import endpoints. In a harness matching the current import code, validation resolvedrebind.testto8.8.8.8, the raw fetch then resolvedrebind.testto127.0.0.1, and the loopback canary returnedloopback-canary-hit:/openapi.json. - For REST datasource/query execution, configure a REST datasource/query URL using the same rebinding hostname. In a harness matching the current helper plus REST undici custom fetch path, a direct loopback URL was blocked and a pinned Node-agent control did not hit loopback, but the REST undici path re-resolved the hostname to
127.0.0.1and returnedREST-UNDICI-REBIND-CANARYfrom the loopback service.
Observed OpenAPI import proof:
{
"outcome": "allowed",
"body": "loopback-canary-hit:/openapi.json",
"lookups": [
{"phase": "guard", "hostname": "rebind.test", "address": "8.8.8.8"},
{"phase": "fetch", "hostname": "rebind.test", "address": "127.0.0.1"}
]
}
Observed REST undici proof:
{
"directControl": {"outcome": "blocked", "hitsAfter": 0},
"pinnedNodeFetchControl": {"outcome": "no_loopback_hit", "hitsAfter": 0},
"undiciBypass": {
"outcome": "allowed",
"status": 200,
"body": "REST-UNDICI-REBIND-CANARY",
"hitsAfter": 1
},
"lookupTrace": [
{"phase": "guard", "hostname": "rebind.test", "address": "8.8.8.8"},
{"phase": "fetch", "hostname": "rebind.test", "address": "127.0.0.1"}
]
}
Root cause and technical details
The central helper now resolves and validates the target hostname, then passes a pinned Node http.Agent or https.Agent to the request. That protects callers whose HTTP client honors the Node agent option.
OpenAPI query import does not use that helper. In packages/server/src/api/controllers/query/import/index.ts, assertUrlIsSafe() calls blacklist.isBlacklisted(parsed.hostname), but fetchFromUrl() then calls fetch(currentUrl, { redirect: "manual" }). That creates a validate-then-fetch gap where DNS can change between the blacklist lookup and the actual connection.
REST datasource/query execution uses the helper but changes the transport semantics. In packages/server/src/integrations/rest.ts, setDispatcher() creates an undici dispatcher with getDispatcher({ rejectUnauthorized, url: requestUrl }), then the custom fetch function calls fetch(requestUrl, setDispatcher(requestInput, requestUrl)). In packages/backend-core/src/utils/outboundFetch.ts, fetchWithBlacklist() passes the pinned Node agent to fetchFn, but undici fetch uses the supplied dispatcher instead. The actual connection performs a second hostname resolution and can be rebound to a blocked address.
Current affected code is present in latest master and in the latest release tag 3.39.14.
Remediation
Route OpenAPI query import through the pinned outbound fetch helper rather than validating and raw-fetching separately.
Make fetchWithBlacklist() pin the actual connection for every supported transport. For undici callers, provide a dispatcher whose lookup or connect behavior is pinned to the validated IP, or reject custom fetch functions that do not explicitly enforce the pinned address. Add regression coverage for direct loopback blocking, DNS rebinding through OpenAPI import, DNS rebinding through REST undici dispatcher, redirect-to-loopback, IPv4-mapped IPv6, and mixed public/private DNS answers.
| Software | From | Fixed in |
|---|---|---|
@budibase / server
|
- | 3.38.1.x |
- https://github.com/Budibase/budibase/commit/1fecb3fc3497e8db7b60b42cc514ce304ffe3a41
- https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3
- https://github.com/Budibase/budibase/commit/586802b5706367520d14245e18a7d0cabab0be11
- https://github.com/Budibase/budibase/pull/19178
- https://github.com/Budibase/budibase/releases/tag/3.39.30
- https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.
CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.
A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.
Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.
Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.
SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.