Description

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-26T14:16:52.293Z",
  "pubdate": "2026-09-26T14:16:52.293Z",
  "executiveSummary": "Budibase versions prior to 3.45.0 are susceptible to an unauthenticated Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability located within the Microsoft Teams webhook endpoint.\nThe vulnerability arises from the insecure processing of Bot Framework activities, specifically the lack of validation on the 'serviceUrl' parameter.\nAn unauthenticated remote attacker can exploit this flaw by submitting a crafted POST request to the webhook endpoint, injecting a malicious 'serviceUrl' that the application persists.\nThis persistence causes the Budibase server to direct all subsequent bot-related communications—including sensitive Microsoft OAuth access tokens transmitted within Authorization headers—to an attacker-controlled host.\nBeyond credential theft, the vulnerability permits the attacker to conduct blind internal network reconnaissance, leveraging the server as a proxy to interact with private services reachable by the Budibase instance.\nThis represents a significant security risk, compromising both identity security via token exfiltration and internal network segmentation.",
  "technicalDetails": "The vulnerability exists in the Microsoft Teams integration component of Budibase, which fails to properly sanitize or validate the 'serviceUrl' field when receiving Bot Framework activities.\nThe attack flow begins when an attacker sends a malicious POST request to the exposed webhook endpoint. By providing a crafted 'serviceUrl' attribute within the JSON payload, the attacker instructs the Budibase server to register this URL as the legitimate destination for bot replies.\nBecause the application persists this malicious value, every subsequent interaction between the Budibase server and the Microsoft Teams framework is diverted to the attacker's infrastructure.\nThe critical impact stems from how the application authenticates its outbound requests. When the server generates a reply, it attaches Microsoft OAuth access tokens to the Authorization header of the request to authenticate the conversation.\nBy redirecting these requests to an attacker-controlled host, the server inadvertently leaks these valid OAuth tokens, enabling the attacker to impersonate the application in downstream Microsoft services.\nFurthermore, the SSRF primitive allows the attacker to force the server to initiate arbitrary network requests. Since the server performs these requests internally, the attacker can probe the local network topology, access internal APIs, or interact with metadata services that are not typically exposed to the public internet.\nThis vulnerability is particularly dangerous because it bypasses conventional authentication mechanisms, requiring no existing credentials to initiate. The exploit is executed in a single request, and the state change persists on the server, ensuring that the attacker continues to receive traffic until the configuration is manually corrected or the service is patched.\nThe combination of blind SSRF and credential exfiltration effectively grants the attacker a persistent foothold within the server's outbound traffic stream, facilitating further lateral movement and potential data exfiltration from integrated enterprise environments."
}