GHSA-hfhx-w8p8-4hc7 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

• npm @budibase/server: <= 3.38.1 (no fix yet)

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Summary The `uploadUrl()` function in `packages/server/src/utilities/fileUtils.ts` uses a bare `fetch(url)` call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachment column values that are strings (URLs). A builder-level user can craft prompts that cause the LLM to generate internal IP addresses or cloud metadata endpoints as attachment URLs. When `generateRows()` calls `processAttachments()`, these URLs are fetched server-side without blacklist validation, allowing the attacker to reach internal services, cloud metadata APIs (169.254.169.254), or other network-internal resources. This is a variant of the same class of issue addressed in other Budibase code paths where `fetchWithBlacklist()` is correctly used to prevent SSRF. Affected Versions { try { const res = await fetch(url) // No blacklist validation ``` This is called from: ```typescript // packages/server/src/sdk/workspace/ai/helpers/rows.ts:104-114 async function processAttachments( entry: Record, attachmentColumns: FieldSchema[] ) { function processAttachment(value: any) { if (typeof value === "object") { return uploadFile(value) } return uploadUrl(value) // String values treated as URLs, fetched without protection } ``` Which is triggered via `generateRows()` at line 34: ```typescript // packages/server/src/sdk/workspace/ai/helpers/rows.ts:34 await processAttachments(entry, attachmentColumns) ``` Compare with correct sibling: processUrlFile() in extract.ts ```typescript // packages/server/src/automations/steps/ai/extract.ts:139-144 async function processUrlFile( fileUrl: string, fileType: SupportedFileType, llm: LLMResponse ): Promise { const response = await fetchWithBlacklist(fileUrl) // Correct: uses blacklist ``` The `fetchWithBlacklist()` function validates each URL (including redirects) against a blacklist of internal/private IP ranges before making the request: ```typescript // packages/server/src/automations/steps/utils.ts:100-112 export async function fetchWithBlacklist( url: string, request: RequestInit = {} ): Promise { const maxRedirects = 5 let nextUrl = url // ... for (let redirects = 0; redirects " \ -H "Cookie: budibase:auth=$TOKEN" The attachment URL in the response points to the saved metadata content ``` Impact • Attacker with builder access can read cloud instance metadata (AWS IAM credentials, GCP service account tokens) • Internal service enumeration and data exfiltration from private network resources • Port scanning of internal infrastructure via timing/error differences • Bypass of network segmentation when Budibase is deployed in a DMZ or VPC Suggested Remediation Replace the bare `fetch()` in `uploadUrl()` with `fetchWithBlacklist()`: ```typescript // packages/server/src/utilities/fileUtils.ts import fs from "fs" -import fetch from "node-fetch" import path from "path" import { pipeline } from "stream" import { promisify } from "util" import * as uuid from "uuid" import { context, objectStore } from "@budibase/backend-core" import { Upload } from "@budibase/types" import { ObjectStoreBuckets } from "../constants" +import { fetchWithBlacklist } from "../automations/steps/utils" // ... export async function uploadUrl(url: string): Promise { try { • const res = await fetch(url) + const res = await fetchWithBlacklist(url) const extension = [...res.url.split(".")].pop()!.split("?")[0] ```