Most recent entries from all

fkie_cve-2026-35219

2026-09-28T16:06:05.179161+00:00

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.

GHSA-5fpj-28rv-84r7 — Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

2026-09-28T16:06:05.179285+00:00

Affected: npm: @budibase/server

## Summary

Budibase automation steps (outgoing webhook, Zapier, n8n, Slack, Discord, Make.com) make server-side HTTP requests to user-provided URLs using `node-fetch` directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist itself defaults to empty when `BLACKLIST_IPS` is not configured.

## Vulnerable Code

### Automation Steps (No Blacklist)

All automation steps use `fetch()` directly without any IP validation:

**`packages/server/src/automations/steps/outgoingWebhook.ts` line 69:** ```typescript const response = await fetch(url, request) // No blacklist check ```

**`packages/server/src/automations/steps/zapier.ts` line 34:** ```typescript response = await fetch(url, {method: "post", ...}) // No blacklist check ```

**`packages/server/src/automations/steps/n8n.ts` line 53:** ```typescript response = await fetch(url, request) // No blacklist check ```

**`packages/server/src/automations/steps/slack.ts` line 20:** ```typescript response = await fetch(url, {method: "post", ...}) // No blacklist check ```

**`packages/server/src/automations/steps/discord.ts` line 29:** ```typescript response = await fetch(url, {method: "post", ...}) // No blacklist check ```

### REST API Integration (Empty Default Blacklist)

**`packages/server/src/integrations/rest.ts` line 684:** ```typescript if (await blacklist.isBlacklisted(url)) { throw new Error("Cannot connect to URL.") } ```

But `BLACKLIST_IPS`…

WID-SEC-W-2026-2849 — Budibase: Mehrere Schwachstellen

2026-09-28T16:06:05.179406+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Dateien zu manipulieren, vertrauliche Daten offenzulegen, erweiterte Berechtigungen zu erlangen und Sicherheitsmaßnahmen zu umgehen.