Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) present in multiple automation steps within Budibase. The root cause is two-fold: firstly, several automation components (for webhooks, Zapier, n8n, Slack, and Discord) were making direct server-side HTTP requests using node-fetch to user-supplied URLs without any IP address validation. This allowed authenticated users to scan internal networks and access internal services. Secondly, the existing blacklist protection mechanism in the REST API integration was opt-in and disabled by default, as it relied on a BLACKLIST_IPS environment variable that was unset in a standard configuration. The patch remediates these issues by enforcing a default blacklist of private IP ranges and implementing a centralized, secure fetch wrapper that performs this validation for all outgoing HTTP requests, replacing the direct, unsafe calls.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @budibase/server | npm | < 3.41.3 | 3.41.3 |
