Budibase webhook query-string trick bypasses all server-side auth
TL;DR - Budibase up to 3.31.4 has a critical auth bypass. Append ?/webhooks/trigger to the query string of any API request and the middleware skips auth and CSRF entirely.
What happened
Budibase is the open-source low-code platform for internal apps. The new CVE is an unauthenticated remote bypass. The isWebhookEndpoint() helper runs an unanchored regex against ctx.request.url (Koa) - which includes the query string. If the regex matches, the middleware returns next() early. So every API endpoint becomes public to anyone who knows to put ?/webhooks/something in the URL.
Elegant in the wrong way. Unanchored regexes against full URLs are one of the most reliable ways to ship an auth bypass in middleware-based Node apps.
Who is impacted
- Budibase deployments running versions
<= 3.31.4. - Impact: complete authentication bypass, broad API access (CRUD over tables/rows/automations/datasources), and CSRF bypass.
- CVSS 3.1: 9.1 (Critical).
What to do now
- Determine whether you are running Budibase
<= 3.31.4. - Until an upstream fix is available, treat server-side APIs as potentially unauthenticated:
- Restrict network access to trusted users/VPN.
- Block requests whose query strings contain
?/webhooks/at a reverse proxy.
- Review access logs for unexpected requests to
/api/*endpoints with webhook-like query fragments.
Related
Research
- Cross-site request forgery (CSRF): how it works and how to defend itCross-site request forgery (CSRF) lets attackers reuse a victim's session cookie from another site. SameSite…
- Session management: secure cookies, rotation, and lifetimeSession management is the spine of authenticated web apps. Use HttpOnly, Secure, SameSite cookies, rotate on…
- AuthenticationA threat-focused guide to authentication, covering attack paths, design pitfalls, and concrete defenses from…
Guides
- Secure session management: cookies, tokens, rotation, and logoutSecure session management means HttpOnly Secure cookies, rotation on privilege change, idle and absolute…
- JWT Security Best PracticesWhat to validate, rotate, and avoid in real systems.
- OAuth 2.0 Security Best PracticesCommon pitfalls in PKCE, tokens, and redirect handling.
Content is AI-assisted and reviewed by our team, but issues may be missed and best practices evolve rapidly, send corrections to [email protected]. Always consult official documentation and validate key implementation decisions before making design or security choices.