Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis is based on the detailed vulnerability description provided, which clearly identifies two SSRF vulnerabilities in the Budibase codebase. The first is a direct SSRF in the fetchToken function, where a user-provided URL is fetched without any blacklist validation. The second is a redirect-based SSRF in the REST integration, where the initial URL is checked but redirects are not, allowing an attacker to bypass the blacklist. The provided PoC demonstrates how these vulnerabilities can be exploited to access internal services and exfiltrate sensitive data. Although the exact commit could not be retrieved, the description provides sufficient detail to identify the vulnerable functions and the nature of the vulnerabilities.
fetchTokenpackages/server/src/sdk/workspace/oauth2/utils.ts
fetchpackages/server/src/integrations/rest.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @budibase/server | npm | < 3.39.0 | 3.39.0 |