Budibase server versions prior to 3.45.0 contain an unauthenticated SSRF vulnerability in the Microsoft Teams webhook endpoint. Attackers can inject a malicious serviceUrl via forged Bot Framework activities, which is persisted and used for subsequent bot replies. This results in the server sending live Microsoft OAuth access tokens in Authorization headers to attacker-controlled URLs, potentially exposing credentials and allowing blind internal network access.

An attacker can exfiltrate Microsoft OAuth access tokens by exploiting the SSRF vulnerability, leading to credential exposure. Additionally, the attacker can perform blind internal network access, potentially enabling further internal attacks or reconnaissance. The vulnerability does not require authentication but has a high attack complexity and low to limited impact on confidentiality and integrity as per the CVSS vector.

A fix is available in Budibase server version 3.45.0. Users should upgrade to version 3.45.0 or later to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.