Budibase is affected by a Server-Side Request Forgery (SSRF) vulnerability that could permit authenticated attackers to interact with internal network infrastructure.

This is a Server-Side Request Forgery (CWE-918) vulnerability. It requires low-privileged authenticated access to trigger the server to perform unauthorized requests to internal or external destinations.

An SSRF vulnerability can be leveraged to bypass network segmentation, probe internal services, or interact with cloud metadata services, leading to potential data exfiltration or escalation of privilege. The CVSS score of 8.5 underscores the critical nature of this flaw when considering the risk to internal network security.

Immediate Action: Upgrade the @budibase/server package to version 3.39.0 or higher.

Proactive Monitoring: Monitor outbound network traffic from the Budibase server for unusual connection attempts to internal IP addresses or restricted services.

Compensating Controls: Use network-level controls such as egress filtering to restrict the Budibase server's ability to communicate with internal resources that it does not explicitly require access to.

Public Exploit Available: No

Given the existence of a proof-of-concept, the risk of exploitation is elevated. Administrators should prioritize updating to version 3.39.0 or later to neutralize the SSRF vector and secure the application infrastructure.