Budibase REST Datasource Credential Theft Vulnerability Under Investigation
An early warning has been issued regarding a potential vulnerability in Budibase that could allow unauthenticated attackers to access stored credentials. Users of affected versions are advised to upgrade and review credentials.
What happened
An early warning has been issued for a vulnerability tracked as GHSA-MQHR-6J6H-74P5, reportedly affecting Budibase. The issue appears to involve Budibase attaching a REST datasource's stored credentials to an outgoing request without checking the destination host. This could allow an attacker to deliver the credentials to a server of their choice. The vulnerability is under investigation and has not been confirmed. Affected versions range from 0 to 3.38.1, with fixes available in versions 3.33.4, 3.38.1, 3.39.0, 3.39.2, 3.39.9, 3.34.8, 3.39.12, 3.35.3, 3.23.32, and 3.39.25. Users are advised to upgrade to the latest version of @budibase/server and review any exposed credentials. For more details, consult the primary sources.
How 0Day mitigates this
@budibase/server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.