Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @budibase/server | npm | <= 3.38.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in the REST datasource integration of Budibase, caused by a DNS rebinding weakness. The core of the issue lies in the interaction between Budibase's fetchWithBlacklist function and the undici HTTP client used by the REST integration.
The fetchWithBlacklist function is designed to prevent SSRF by resolving a hostname, validating its IP against a blacklist, and then 'pinning' the request to that validated IP using a Node.js agent. However, the REST integration overrides the default fetch implementation with undici's fetch. The undici client ignores the Node.js agent and its IP pinning, and instead uses its own dispatcher mechanism, which re-resolves the hostname's DNS at connection time.
This creates a Time-of-Check, Time-of-Use (TOCTOU) vulnerability. An attacker can use a malicious DNS server that returns a safe, public IP during the initial validation by fetchWithBlacklist, but then returns an internal, blacklisted IP (like 127.0.0.1 or a cloud metadata endpoint) when undici resolves the hostname again just before making the connection. This bypasses the blacklist and allows the attacker to make requests to internal services.
The vulnerable functions were identified by analyzing the provided patches, which show how the IP pinning was enforced for undici:
RestIntegration.query in packages/server/src/integrations/rest.ts was modified to pass a pinnedIp to its undici dispatcher.fetchWithBlacklist in packages/backend-core/src/utils/outboundFetch.ts was updated to provide this pinnedIp to the custom fetch function.getDispatcher in packages/backend-core/src/utils/fetch.ts was changed to accept a lookup function to enforce the IP pinning within undici's Agent.fetchFromUrlpackages/server/src/api/controllers/query/import/index.tsfetchWithBlacklistRestIntegration.querypackages/server/src/integrations/rest.ts
fetchWithBlacklistpackages/backend-core/src/utils/outboundFetch.ts
getDispatcherpackages/backend-core/src/utils/fetch.ts
fetchFromUrlpackages/server/src/api/controllers/query/import/index.ts