GHSA-pvcr-8mvp-w8qr Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

• npm @budibase/server: <= 3.38.1 (no fix yet)

Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an external chat identity (Slack/Discord/MS Teams/Telegram) to a Budibase user account. The confirmation endpoint is on a public route (no CSRF middleware, no auth-group gate) and the only credential it checks is a `confirmationToken` that is already rendered in plaintext into the HTML confirmation page the victim views. There is no binding between the confirmation token and the requester's Budibase session at preparation time, and no CSRF token on the POST. Consequently, an attacker who creates a chat-link session for their own external chat identity (or any identity they can mint in their chat platform) can induce a victim Budibase user (same tenant) to submit the confirmation POST -> for example by sending them a link that auto-submits, or by XSS/CSRF on a co-tenanted page -> and the victim's `globalUserId` becomes bound to the attacker's external identity. The attacker then sends messages to the AI agent from their chat platform and is acting as the victim user inside Budibase automations/agent operations, inheriting the victim's permissions on agent operations, knowledge sources, and any downstream automation steps keyed off the linked identity. --- Affected | Component | Path | Lines | |---|---|---| | Public handoff routes (no auth-group middleware) | `packages/server/src/api/routes/chat.ts` | `23` (`GET /api/chat-links/:instance/:token/handoff`), `27` (`POST .../handoff`) | | Confirmation controller | `packages/server/src/api/controllers/ai/chatIdentityLinks.ts` | `124-177` (`confirmChatLinkSession`); the binding at `153-173` | | Confirmation token rendered into HTML | `packages/server/src/api/controllers/ai/chatIdentityLinks.ts` | `40-60` (`renderLinkConfirmationPage`); the hidden input at `55` | | Session creation (attacker side) | `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts` | `138-171` (`createChatIdentityLinkSession`), `173-188` (`prepareChatIdentityLinkSessionConfirmation`) | | Upsert of identity link | `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts` | `201-250` (`upsertChatIdentityLink`) | Affected versions: `master` at commit `3c8d1b4023`. Reachable over HTTP by: the GET and POST are on `publicRoutes` (no auth-group middleware). The POST requires `ctx.isAuthenticated` at runtime (`controllers/ai/chatIdentityLinks.ts:142`) -> so the victim must be logged into Budibase when the POST fires (achievable via standard CSRF if cookies are sent cross-origin, or via phishing that lures the victim to submit). --- Root cause Issue 1 -> The handoff routes are public and unauthenticated at the middleware layer. ```ts // packages/server/src/api/routes/chat.ts:23, 27 publicRoutes.get("/api/chat-links/:instance/:token/handoff", ai.handoffChatLinkSession) publicRoutes.post("/api/chat-links/:instance/:token/handoff", ai.confirmChatLinkSession) ``` `publicRoutes` has no group middleware (`endpointGroups/standard.ts:24-25` calls `endpointGroupList.group()` with no middleware and then `.lockMiddleware()`). The routes do not have a per-route `authorized(...)`. There is no CSRF middleware on these routes -> Budibase's CSRF synchroniser token is enforced only for state-changing verbs on authenticated routes that are not in `NO_CSRF_ENDPOINTS`; the public-routes path bypasses it. Issue 2 -> The confirmation token is exposed to anyone who views the GET page. ```ts // packages/server/src/api/controllers/ai/chatIdentityLinks.ts:40-60 const renderLinkConfirmationPage = (session, action) => { ... return `... Confirm ...` } ``` The `confirmationToken` (a `newid()` UUIDv4 generated by `prepareChatIdentityLinkSessionConfirmation`) is rendered into a hidden form input. Anyone who loads the GET page sees the token in the page source. Issue 3 -> The POST binds the currently-authenticated user to the external identity based solely on the confirmation token. ```ts // packages/server/src/api/controllers/ai/chatIdentityLinks.ts:124-177 export async function confirmChatLinkSession(ctx) { ... if (!ctx.isAuthenticated) { throw new HTTPError("Authentication is required to link chat identity", 401) } if (!session.confirmationToken || ctx.request.body?.confirmationToken !== session.confirmationToken) { throw new HTTPError("Link confirmation is invalid or has expired", 400) } const currentGlobalUserId = getCurrentGlobalUserId(ctx) // `assertSessionMatchesInstance` only checks workspace ID, not user. ```ts // packages/server/src/api/controllers/ai/chatIdentityLinks.ts:17-27 const assertSessionMatchesInstance = ({ workspaceId, instance }) => { if (!workspaceId || workspaceId !== instance) { throw new HTTPError("Link token is not valid for this workspace", 400) } } ``` The check confirms the session belongs to the same workspace as the URL `instance` param -> useful for preventing cross-workspace confusion but useless against same-tenant identity confusion. --- Reproduction Step-by-step attack 1. Attacker (tenant T) provisions a chat-link session for their own external identity. Via the agent channel provisioning flow (e.g. `POST /api/agent/:agentId/slack/provision` or via the Discord/MS Teams/Telegram provisioning endpoints), the attacker obtains a chat-link `token` bound to their own Slack user ID. The session is stored in Redis keyed by `token`, scoped to tenant T. 2. Attacker triggers `prepareChatIdentityLinkSessionConfirmation`. Either by GETting the handoff page themselves (if they have a Budibase session) or via an internal API. The `confirmationToken` is generated and stored. 3. Attacker crafts a phishing/auto-submit page that POSTs to `/api/chat-links///handoff` with the leaked `confirmationToken` in the body. Example: ```html "> document.getElementById('f').submit() ``` 4. Victim (a Budibase user in tenant T, e.g. an admin) is lured to the attacker page while logged into Budibase. Their browser sends the POST cross-origin. If the Budibase auth cookie is sent on cross-site requests (`SameSite=Lax` by default allows top-level POST navigations, which a form-submit is), the request is authenticated as the victim. 5. The victim's `globalUserId` is now bound to the attacker's Slack identity. When the attacker DMs the AI agent from Slack, the agent's operations run as the victim user -> with the victim's permissions on agent operations, knowledge sources, file uploads, and any downstream automation steps keyed off the linked identity. Mitigating factors:** • `SameS…