Budibase SSO Takeover and DNS Rebinding Security Fixes

Vulnerability Overview The webpage screenshot displays the release notes for Budibase version 3.39.30, which includes several security-related fixes and improvements. Specifically, it addresses the following vulnerabilities and enhancements: 1. Realtime WebSocket updates for the Agent Requests Activity table - Fixed issues with Realtime WebSocket updates to ensure the real-time update functionality of the Agent Requests Activity table operates correctly. 2. Live update pagination and summary counts on Activity page - Resolved issues with live pagination and summary counts on the Activity page to ensure data update accuracy. 3. Add status filter dropdown to Activity requests table - Added a status filter dropdown to the Activity requests table, allowing users to conveniently filter requests by specific statuses. 4. Track status changes in the actions timeline - Improved the tracking of status changes within the actions timeline to ensure accurate recording of status modifications. 5. Add actions timeline data model and user interaction tracking - Added a data model for the actions timeline and user interaction tracking capabilities, enhancing system traceability. 6. View fix for external db on column delete - Fixed issues occurring when deleting columns in external databases to ensure data consistency. 7. Secfix/sso takeover by @calexiou - Addressed a security vulnerability involving SSO (Single Sign-On) takeover, preventing unauthorized access. 8. Make rollout strategy and imagePullPolicy configurable in Helm chart by @calexiou - Made rollout strategy and imagePullPolicy configurable within the Helm chart, improving deployment flexibility and security. 9. Secfix/dns rebinding openapi rest by @calexiou - Mitigated a DNS rebinding attack vulnerability, ensuring the security of API calls. 10. Fix: partial removal of stalled cron jobs by @Dakuan - Fixed an issue regarding the partial removal of stalled cron jobs to ensure stable system operation. 11. Track AgentRequest status through the full escalation lifecycle by @jvcalderson - Enhanced the tracking of Agent request statuses throughout the entire escalation lifecycle to ensure accurate status recording. 12. Unify usage of Helpers.uuid for unsecured browsers by @adrinr - Standardized the usage of in unsecured browsers, improving the consistency and security of data processing. 13. Fix free plan workspace and plugin quotas by @ConorWebb - Resolved issues related to workspace and plugin quotas for the free plan, ensuring reasonable resource allocation. 14. Bind chat identity link confirmation to the current user by @adrinr - Linked chat identity link confirmation to the current user, enhancing chat security. 15. Judge agent request outcome (completed/failed) via LLM instead of tool-failure counting by @jvcalderson - Implemented the use of an LLM to determine the outcome (completed/failed) of Agent requests, replacing tool-failure counting to improve judgment accuracy. 16. Track escalation timeline actions (escalation_raised, escalation_resolved) by @jvcalderson - Improved the tracking of escalation timeline actions, ensuring accurate recording of escalation operations. 17. Track tool call actions in the AgentRequest timeline by @jvcalderson - Enhanced the tracking of tool call actions within the AgentRequest timeline, improving system traceability. 18. feat: async sharepoint sync by @Dakuan - Added asynchronous SharePoint synchronization functionality, improving the efficiency and stability of data synchronization. 19. Fix: can miss sharepoint name on partial failure by @Dakuan - Fixed an issue where the SharePoint name might be missed in the event of a partial failure, ensuring data integrity. 20. Fix: don't attempt to ingest large sharepoint files by @Dakuan - Addressed the issue of attempting to ingest large SharePoint files, preventing excessive consumption of system resources. 21. Split couchinfo between internal and external by @adrinr - Separated CouchDB information into internal and external categories, enhancing the flexibility and security of data management. 22. Fix mysql test docker-compose, updating it to mysql 9 by @adrinr - Fixed the MySQL test configuration and updated it to MySQL 9, ensuring the stability of the test environment. Scope of Impact These fixes and improvements primarily affect users of Budibase version 3.39.30, particularly those utilizing Realtime WebSocket, the Activity page, Agent Requests table, SSO, Helm charts, DNS rebinding protections, cron jobs, Agent request status tracking, , free plan quotas, chat identity links, LLM-based judgment, escalation timelines, tool call operations, SharePoint synchronization, CouchDB information management, and the MySQL test environment. Remediation 1. Realtime WebSocket updates: Ensure the real-time update functionality of the Agent Requests Activity table operates correctly. 2. Live update pagination and summary counts: Resolve issues with live pagination and summary counts on the Activit

Goal Reached Thanks to every supporter — we hit 100%!

Budibase SSO Takeover and DNS Rebinding Security Fixes

More from this source