GHSA-xg5g-26x8-cvf4

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

Published

2026-07-24

Modified

2026-07-24

Sources

github-advisory

Summary

## Impact A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer. The first path is OpenAPI query import. It validates the supplied hostname with the blacklist and then performs a separate raw fetch. A hostname that resolves to a public address during validation and to `127.0.0.1` during the request is accepted. The second path is REST datasource/query execution. It calls the fixed `fetchWithBlacklist()` helper, but provides a custom undici `fetchFn` that installs a `dispatcher`. The helper passes a pinned Node `agent`, but undici uses the dispatcher and resolves the original hostname again at connection time. This defeats the DNS pinning added for the previous outbound fetch advisory. Impact is authenticated SSRF from the Budibase server process. An attacker with the relevant builder/query privileges can reach loopback or private HTTP services that should be blocked by Budibase's outbound fetch protections, subject to the normal response handling of each feature. ## Reproduction 1. Configure an attacker-controlled hostname so the validation lookup returns a public IP address and the later request lookup returns an internal address such as `127.0.0.1`. 2. Start a loopback canary HTTP service on the Budibase host. 3. For OpenAPI query import, submit an import URL such as `http://rebind.test: /openapi.json` through the builder query import endpoints. In a harness matching the current import code, validation resolved `rebind.test` to `8.8.8.8`, the raw fetch then resolved `rebind.test` to `127.0.0.1`, and the loopback canary returned `loopback-canary-hit:/openapi.json`. 4. For REST datasource/query execution, configure a REST datasource/query URL using the same rebinding hostname. In a harness matching the current helper plus REST undici custom fetch path, a direct loopback URL was blocked and a pinned Node-agent control did not hit loopback, but the REST undici path re-resolved the hostname to `127.0.0.1` and returned `REST-UNDICI-REBIND-CANARY` from the loopback service. Observed OpenAPI import proof: ```json { "outcome": "allowed", "body": "loopback-canary-hit:/openapi.json", "lookups": [ {"phase": "guard", "hostname": "rebind.test", "address": "8.8.8.8"}, {"phase": "fetch", "hostname": "rebind.test", "address": "127.0.0.1"} ] } ``` Observed REST undici proof: ```json { "directControl": {"outcome": "blocked", "hitsAfter": 0}, "pinnedNodeFetchControl": {"outcome": "no_loopback_hit", "hitsAfter": 0}, "undiciBypass": { "outcome": "allowed", "status": 200, "body": "REST-UNDICI-REBIND-CANARY", "hitsAfter": 1 }, "lookupTrace": [ {"phase": "guard", "hostname": "rebind.test", "address": "8.8.8.8"}, {"phase": "fetch", "hostname": "rebind.test", "address": "127.0.0.1"} ] } ``` ## Root cause and technical details The central helper now resolves and validates the target hostname, then passes a pinned Node `http.Agent` or `https.Agent` to the request. That protects callers whose HTTP client honors the Node `agent` option. OpenAPI query import does not use that helper. In `packages/server/src/api/controllers/query/import/index.ts`, `assertUrlIsSafe()` calls `blacklist.isBlacklisted(parsed.hostname)`, but `fetchFromUrl()` then calls `fetch(currentUrl, { redirect: "manual" })`. That creates a validate-then-fetch gap where DNS can change between the blacklist lookup and the actual connection. REST datasource/query execution uses the helper but changes the transport semantics. In `packages/server/src/integrations/rest.ts`, `setDispatcher()` creates an undici dispatcher with `getDispatcher({ rejectUnauthorized, url: requestUrl })`, then the custom fetch function calls `fetch(requestUrl, setDispatcher(requestInput, requestUrl))`. In `packages/backend-core/src/utils/outboundFetch.ts`, `fetchWithBlacklist()` passes t

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-xg5g-26x8-cvf4