Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @budibase/server | npm | <= 3.38.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is an OAuth2 token disclosure in Budibase's automation testing feature. The root cause is the getUserContextBindings function, which includes sensitive OAuth2 tokens in the user context for automations. These tokens are then included in the automation test results. The test function in packages/server/src/api/controllers/automation.ts would then take these results and broadcast them without sanitization. The disclosure happened in two ways: first, the results were broadcasted to all builders of the same application via a WebSocket message sent by emitToRoom. Second, the results were stored in an in-memory cache by recordTestProgress without user-specific scoping, allowing any builder to retrieve them using the getTestProgress function. The patch addresses this by introducing a sanitizeAutomationTestResult function to strip the OAuth2 tokens from the results before they are broadcasted or stored, and by adding user-scoping to the test progress cache.
getUserContextBindingspackages/server/src/sdk/users/utils.ts
testpackages/server/src/api/controllers/automation.ts
recordTestProgresspackages/server/src/automations/testProgress.ts
getTestProgresspackages/server/src/automations/testProgress.ts
emitToRoompackages/server/src/websockets/websocket.ts