Horizon Alert
Summary of the vulnerability and why it matters
This issue affects Budibase, an open-source low-code platform, where a flaw in how it checks for public access allows authenticated users to bypass security controls. By manipulating URLs, an attacker could access protected endpoints that should require login. This means sensitive data or system functions could be exposed without proper authorization.
- Attackers can bypass authentication.
- Access to protected endpoints is possible.
- The low-code platform is the affected technology.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can bypass authentication on Budibase versions prior to 3.35.4 by crafting a request to a public endpoint that also includes a protected endpoint in its query string. This causes the application's middleware to incorrectly match the protected endpoint within the query string, granting unauthorized access.
- Unauthenticated access to protected endpoints.
- Append protected path as query parameter.
- Exploitable via network requests.
Live Threat
Current exploitation, exposure, and threat context
Attackers will likely find this vulnerability appealing due to its ability to bypass authentication on sensitive endpoints without requiring any privileges or user interaction. The core issue lies in how the application handles URL matching, allowing a crafted query parameter to trick the authentication middleware. This type of flaw is attractive because it can grant immediate access to protected functionalities.
- Exploitable via unauthenticated requests.
- Exploitation is straightforward with a crafted URL.
- Publicly disclosed with a fix available.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize updating Budibase to version 3.35.4 or later immediately, as this vulnerability allows unauthenticated attackers to bypass access controls and reach protected endpoints. If immediate patching is not feasible, implement network-level controls to block access to vulnerable endpoints, such as specific API paths known to be exploitable.
- Update Budibase to 3.35.4.
- Block direct access to public-facing APIs.
- Monitor logs for suspicious requests.
