Budibase REST Datasource Credential Theft

Budibase is currently affected by a critical vulnerability that allows unauthenticated users to exfiltrate sensitive credentials from REST datasources. Because the application fails to validate the destination host before attaching stored authentication tokens, attackers can redirect outgoing requests to arbitrary servers.

This flaw is reachable by any unauthenticated attacker through a single HTTP request, provided the affected query is published with the PUBLIC role. This issue represents a bypass of previous security measures intended to restrict URL rewriting, effectively exposing cleartext credentials that are otherwise masked within the platform's API.

What's at Risk

The vulnerability affects the @budibase/server package. Organizations utilizing Budibase to manage REST API integrations are at risk, particularly those with internet-facing deployments where queries have been configured with public access.

When these systems are exposed, any actor with network access to the instance can potentially trigger the vulnerable query execution path. This results in the unauthorized disclosure of Bearer tokens, Basic authentication credentials, and static headers, which could then be leveraged to compromise downstream services connected to the Budibase instance.

How the Flaw Works

This vulnerability is a form of Server-Side Request Forgery (SSRF) combined with improper input validation. In general, this class of weakness occurs when an application processes user-supplied input to construct network requests without verifying the target destination. When an application is designed to automatically append authentication headers to outgoing traffic, the failure to validate the host allows the application to act as a confused deputy.

Attackers typically exploit this by supplying an absolute URL or a parameter-injected path that points to a server under their control. Because the application logic attaches the stored credentials before the final destination is resolved, the sensitive data is transmitted directly to the attacker's endpoint. This bypasses typical Same-Origin Policy protections that might otherwise prevent such leaks in a browser-based context.

How to Protect Your Systems

• Review all existing REST datasource configurations to identify queries that may be exposed to unauthorized users.
• Restrict access to sensitive queries by changing the execution role from PUBLIC to a restricted, authenticated role.
• Monitor server logs for unusual outgoing requests to unknown or external domains originating from the Budibase backend.
• Implement network-level egress filtering to prevent the application server from initiating connections to unauthorized or untrusted external hosts.
• Ensure that all Budibase instances are deployed within a secure, segmented network environment to limit the impact of potential service compromises.

Given the critical severity of this flaw and the potential for full credential theft, administrators should prioritize auditing their datasource configurations immediately. Since no official patch is currently available, limiting public access to query endpoints remains the most effective method to mitigate the risk of exploitation.