Buddibase SSRF via DNS rebinding bypass in REST datasource integration

Vulnerability Overview Vulnerability Name: SSRF via DNS rebinding in the REST datasource integration Vulnerability Description: Buddibase's central egress fetch guard ( ) prevents SSRF/DNS rebinding by resolving the target hostname and checking if each resolved IP is in the blocked list. This guard is implemented using the Node agent ( ) in . However, the REST datasource integration ( ) calls but uses to execute the actual request. Since does not support Node agents, the option is ignored, and its own dispatcher is used. When the REST datasource path resolves the hostname DNS again at connection time, the validated pinned IP is not used for the REST datasource path, causing the DNS rebinding protection to be bypassed. CVSS Score: 8.5/10 (High) Affected Versions Affected Versions: <3.40.0 Fixed Version: 3.40.0 Impact Type: Server-Side Request Forgery (SSRF) Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High Specific Impacts: Reading IAM credentials Cloud account compromise Reading internal CouchDB (applications, users, and secrets for all tenants) Unauthorized access to local services via PUT/POST/DELETE Creating admin documents, modifying tenant data Deleting databases/flushing Redis, resulting in data loss for all tenants Remediation Recommended Fix: Ensure that the validated IP is respected when the request is actually executed. In , construct an agent using ( or custom connection) that returns the resolved IP (similar to ). For , the dispatcher should not resolve DNS; instead, it should check if the resolved peer IP is blocked within the connection callback in . The Node agent should not be relied upon when making requests via . POC Code Expected Output How to Interpret (A) The actual validates and pins the safe public IP , but the REST datasource path re-resolves and reaches —— the internal service responds —— SSRF bypass. (B) The default path respects the pinned agent (failing due to inability to resolve ) and does not reach the internal service. The failed connection to the resolved IP string is generated by , proving the guard works normally. This serves as a negative control for localizing the vulnerability. Real-World Variants Conversely, an attacker can use a domain they control that returns a public IP with a 0-second TTL, and resolves to an internal IP ( , , internal CouchDB/Redis) at connection time in . The REST datasource query then returns the internal response body to the attacker. Impact Type: Server-Side Request Forgery (SSRF) (CWE-918 + CWE-367) Impact: Full response and arbitrary HTTP methods/bodies (REST datasources allow callers to select methods, headers, and bodies) Affected: Any Buddibase deployed on affected versions, particularly multi-tenant or Buddibase-Cloud-style managed environments where builders/tenants are untrusted with respect to host-internal access. The SSRF blacklist is meant to contain these users; this bypass defeats it. Real-World Worst Case An authenticated builder/tenant points a REST datasource to a rebound host and uses the server to: Read IAM credentials ( ) —— steal IAM credentials —— compromise cloud accounts Read internal CouchDB ( , ) —— access applications, users, and secrets for all tenants Unauthorized access to local services via PUT/POST/DELETE —— create admin documents, modify tenant data Delete databases/flush Redis —— data loss for all tenants CVSS 3.1 Vector Rationalization Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H —— Base 8.5 (High) Note: AC:H is the standard, defensible DNS rebinding score; if rebinding is considered reliable (TTL-0 framework), AC:L produces CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9 (Critical). A conservative read-only interpretation (I:N/A:N) yields 6.8 (Medium). The recommended 8.5 (High) maximizes real-world impact while maintaining exploitability honesty, and is consistent with parent advisory GHSA-v42l-v8xc-j435. Suggested Fix Ensure that the validated IP is respected when the request is actually executed. In , construct an agent using ( or custom connection) that returns the resolved IP (similar to ). For , the dispatcher should not resolve DNS; instead, it should check if the resolved peer IP is blocked within the connection callback in . The Node agent should not be relied upon when making requests via .

Goal Reached Thanks to every supporter — we hit 100%!

Buddibase SSRF via DNS rebinding bypass in REST datasource integration

More from this source