| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| @budibase/server | < 3.39.25 | 3.39.25 |
The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity provider credentials to other users who should not have access to them.
When a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at packages/backend-core/src/auth/auth.ts:170-173:
dbUser.oauth2 = {
...dbUser.oauth2,
...details,
}
await db.put(dbUser)
The user metadata endpoints are protected by PermissionType.USER, PermissionLevel.READ (packages/server/src/api/routes/user.ts:11), which maps to the POWER permission set (packages/backend-core/src/security/permissions.ts:99).
Path 1 — List all users (GET /api/users/metadata):
controller.fetchMetadata → sdk.users.fetchMetadata() (packages/server/src/sdk/users/utils.ts:78)getGlobalUsers() → getRawGlobalUsers() (packages/server/src/utilities/global.ts:101-122) — strips only password and forceResetPasswordprocessUser() (packages/server/src/utilities/global.ts:15-76) — strips only password and rolesoauth2 field containing accessToken and refreshToken is never removedPath 2 — Single user (GET /api/users/metadata/:id):
controller.findMetadata → getFullUser() (packages/server/src/utilities/users.ts:6)getGlobalUser() → getRawGlobalUser() (packages/server/src/utilities/global.ts:90-92) — raw CouchDB fetch, no field stripping at allprocessUser() — strips only password and rolesoauth2 tokens are returnedThere is no output sanitization middleware on these routes that would strip sensitive fields before the response reaches the client.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíPrerequisites: A Budibase instance with at least one SSO-authenticated user (OIDC or Google) and a separate user with POWER role in an app.
Step 1 — As the POWER user, list all users:
curl -s -X GET 'http://localhost:10000/api/users/metadata' \
-H 'Cookie: budibase:auth=<power-user-jwt>' \
-H 'x-budibase-app-id: app_<appid>' | jq '.[].oauth2'
Expected output: null for all users (tokens should not be exposed)
Actual output: For SSO users, the response includes:
{
"accessToken": "ya29.a0ARrdaM...",
"refreshToken": "1//0eXxXxXxXx..."
}
Step 2 — Fetch a specific SSO user's profile:
curl -s -X GET 'http://localhost:10000/api/users/metadata/ro_ta_users_us_<sso-user-id>' \
-H 'Cookie: budibase:auth=<power-user-jwt>' \
-H 'x-budibase-app-id: app_<appid>' | jq '.oauth2'
This also returns the full OAuth2 tokens.
admin, builder, tenantId, ssoId, and userGroups fields are leaked, revealing the full authorization topology of the instance.Strip sensitive SSO fields in processUser() at packages/server/src/utilities/global.ts:15:
export async function processUser(
user: ContextUser,
opts: { appId?: string; groups?: UserGroup[] } = {}
) {
if (!user || (!user.roles && !user.userGroups)) {
return user
}
user = cloneDeep(user)
delete user.password
+ delete (user as any).oauth2
+ delete (user as any).provider
+ delete (user as any).providerType
+ delete (user as any).thirdPartyProfile
+ delete (user as any).profile
+ delete (user as any).ssoId
+ delete (user as any).forceResetPassword
// ... rest of function
Additionally, getRawGlobalUsers() at line 101 should also strip oauth2 alongside its existing password/forceResetPassword stripping for defense in depth.