Description

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-17T21:16:48.823Z",
  "pubdate": "2026-08-17T21:16:48.823Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability related to DNS rebinding exists in the Budibase low-code platform prior to version 3.40.0. The vulnerability allows a builder to bypass initial address validation checks through DNS rebinding techniques, leading to unauthorized access to internal network resources.\nThe affected product is Budibase, specifically versions prior to 3.40.0, impacting components responsible for backend core utilities and REST integrations.\nThe risk implications include potential exposure of internal services, unauthorized data retrieval with full response access, and execution of arbitrary REST methods against internal network endpoints that should otherwise be protected.\nAn attacker with builder capabilities can exploit this vulnerability by manipulating DNS resolution timings during outbound requests.\nSuccessful exploitation requires the capability to configure REST integrations within the platform and control a malicious DNS server capable of altering IP responses between validation and connection phases.",
  "technicalDetails": "The root cause of the vulnerability stems from a discrepancy in how outbound network requests are handled between general backend utilities and REST integrations within the codebase. Specifically, packages/backend-core/src/utils/outboundFetch.ts previously pinned a validated IP address through a Node agent to prevent unauthorized routing. However, the REST integration implemented in packages/server/src/integrations/rest.ts utilized getDispatcher from packages/backend-core/src/utils/fetch.ts.\nThis architectural implementation caused the underlying HTTP client library, undici, to ignore the previously pinned agent and perform a secondary hostname resolution. Consequently, a time-of-check to time-of-use race condition via DNS rebinding is introduced.\nThe attack flow proceeds as follows: First, a malicious builder initiates a REST integration request targeting a domain controlled by the attacker. Second, the initial validation phase resolves the domain to a benign public IP address, which successfully passes security checks. Third, when the actual request is dispatched, undici resolves the hostname a second time. By utilizing a malicious DNS server configured with a very low Time-To-Live (TTL), the second resolution returns a sensitive internal IP address instead of the public one.\nAs a result, packages/server/src/integrations/rest.ts connects to the internal address while bypassing the initial validation. The attacker gains the ability to execute arbitrary REST methods and achieve full response access to internal services residing on the network.\nThe vulnerable components include packages/backend-core/src/utils/fetch.ts, packages/backend-core/src/utils/outboundFetch.ts, and packages/server/src/integrations/rest.ts. Affected versions comprise all Budibase installations prior to version 3.40.0."
}