CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.40.0 are vulnerable to server-side request forgery (SSRF) attacks, enabling authenticated builder-level users to exploit DNS rebinding vulnerabilities. This allows attackers to bypass DNS pinning protections, potentially gaining unauthorized access to internal HTTP services that should be restricted. Organizations using affected versions should prioritize patching to mitigate the risk of internal service exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.