{"id":"GHSA-v7j5-vc4m-723w","summary":"Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF","details":"## Title\n\n**Chat Identity Link Hijacking — Attacker Can Silently Map Their Slack/Discord Identity to Any Authenticated Budibase User's Account**\n\n## Severity\n\n**High** — CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N = **7.3**\n\n## Affected Product\n\n- **Product:** Budibase\n- **Version:** 3.37.2 (introduced in this version)\n- **Component:** `packages/server/src/api/controllers/ai/chatIdentityLinks.ts`\n- **Endpoint:** `GET /api/chat-links/:instance/:token/handoff`\n\n\n## Vulnerability Type\n\n- CWE-352: Cross-Site Request Forgery\n- CWE-284: Improper Access Control\n\n---\n\n## Vulnerability Description\n\n`GET /api/chat-links/:instance/:token/handoff` is a **public endpoint** (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with **no consent UI and no CSRF protection**.\n\nThe session token in the URL is created **by the attacker** (from their own `/link` slash command) and embeds **the attacker's `externalUserId`**. When an authenticated Budibase victim visits the URL, their account is silently and permanently linked to the attacker's Slack/Discord identity. The server responds with `\"Authentication succeeded.\"` — no indication of what was linked.\n\n### Route Registration\n\n```typescript\n// packages/server/src/api/routes/chat.ts:22\nrouter.get(\n  \"/api/chat-links/:instance/:token/handoff\",\n  controller.handoffChatLinkSession   // registered in publicRoutes — zero auth middleware\n)\n```\n\n### Vulnerable Controller (full function)\n\n```typescript\n// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:61–110\nexport async function handoffChatLinkSession(\n  ctx: UserCtx\u003cvoid, string, { instance: string; token: string }\u003e\n) {\n  const token = resolveToken(ctx.params.token)\n  const session = await sdk.ai.chatIdentityLinks.getChatIdentityLinkSession(token)\n  if (!session) {\n    throw new HTTPError(\"Link token is invalid or has expired\", 400)\n  }\n  assertSessionMatchesInstance({ workspaceId: session.workspaceId, instance: ctx.params.instance })\n\n  if (!ctx.isAuthenticated) {\n    // Unauthenticated: set return URL cookie, redirect to login\n    // After login, same URL is visited again → attack completes silently\n    utils.setCookie(ctx,\n      `/api/chat-links/${ctx.params.instance}/${token}/handoff`,\n      \"budibase:returnurl\",\n      { sign: false }  // ← unsigned cookie, but not an open redirect\n    )\n    ctx.redirect(\"/builder/auth/login\")\n    return\n  }\n\n  const currentGlobalUserId = getCurrentGlobalUserId(ctx)\n  const consumedSession = await sdk.ai.chatIdentityLinks.consumeChatIdentityLinkSession(token)\n\n  // ↓↓↓ THE VULNERABLE WRITE — no consent check, no CSRF token ↓↓↓\n  await sdk.ai.chatIdentityLinks.upsertChatIdentityLink({\n    provider: consumedSession.provider,\n    externalUserId: consumedSession.externalUserId,  // ← ATTACKER's Slack ID\n    externalUserName: consumedSession.externalUserName,\n    teamId: consumedSession.teamId,\n    globalUserId: currentGlobalUserId,   // ← VICTIM's Budibase user ID\n    linkedBy: currentGlobalUserId,\n  })\n\n  ctx.type = \"text/html\"\n  ctx.body = renderLinkSuccessPage()  // ← \"Authentication succeeded.\" — no disclosure to user\n}\n```\n\n--\n\n---\n\n### Step 1 — Attacker triggers `/link` in Slack\n\nAttacker types `/link` to the Budibase Slack bot. Budibase server creates a Redis session:\n\n**Redis key:** `chatIdentityLinkSession:tok_xxxxxxxxxxxxxxxx`\n\n**Redis value (exact structure from `ChatIdentityLinkSession` interface):**\n```json\n{\n  \"token\": \"tok_xxxxxxxxxxxxxxxx\",\n  \"tenantId\": \"acme\",\n  \"workspaceId\": \"ws_abc123\",\n  \"provider\": \"slack\",\n  \"externalUserId\": \"UA12345678\",\n  \"externalUserName\": \"attacker\",\n  \"teamId\": \"T_ACME_SLACK\",\n  \"createdAt\": \"2026-05-02T10:00:00.000Z\",\n  \"expiresAt\": \"2026-05-02T10:10:00.000Z\"\n}\n```\n\nSlack DM sent privately to attacker:\n```\nLink your Slack account to continue chatting with this agent.\nhttps://budibase.company.com/api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff\n```\n\n**Key observation:** This URL embeds the attacker's own `externalUserId` inside the token. The attacker has full control over which identity gets linked.\n\n---\n\n### Step 2 — Attacker forwards URL to victim\n\nAttacker posts in the company Slack:\n```\n@admin please click this to connect your Budibase account for AI agent access:\nhttps://budibase.company.com/api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff\n```\n\n---\n\n### Step 3 — Victim clicks link (authenticated)\n\n**HTTP Request (victim's browser):**\n```http\nGET /api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff HTTP/1.1\nHost: budibase.company.com\nCookie: budibase:session=VICTIM_SESSION\n```\n\n**HTTP Response:**\n```http\nHTTP/1.1 200 OK\nContent-Type: text/html\n\n\u003c!doctype html\u003e\n\u003chtml lang=\"en\"\u003e\n  \u003chead\u003e\n    \u003cmeta charset=\"utf-8\"\u003e\n    \u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1\"\u003e\n    \u003ctitle\u003eAuthentication succeeded\u003c/title\u003e\n  \u003c/head\u003e\n  \u003cbody\u003e\n    \u003cp\u003eAuthentication succeeded.\u003c/p\u003e\n    \u003cscript\u003e\n      if (window.opener && !window.opener.closed) {\n        try { window.opener.focus(); window.close() } catch (error) {}\n      }\n    \u003c/script\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\nThe victim sees \"Authentication succeeded.\" with no mention of Slack, no mention of `attacker`, no mention of what capabilities were granted.\n\n**CouchDB global-db document written immediately after (exact structure from `upsertChatIdentityLink`):**\n\n```json\n{\n  \"_id\": \"chatidentitylink_acme_slack_T_ACME_SLACK_UA12345678\",\n  \"tenantId\": \"acme\",\n  \"provider\": \"slack\",\n  \"externalUserId\": \"UA12345678\",\n  \"globalUserId\": \"ro_global_us_VICTIM_ADMIN_ID\",\n  \"linkedAt\": \"2026-05-02T10:00:42.000Z\",\n  \"linkedBy\": \"ro_global_us_VICTIM_ADMIN_ID\",\n  \"externalUserName\": \"attacker\",\n  \"teamId\": \"T_ACME_SLACK\",\n  \"createdAt\": \"2026-05-02T10:00:42.000Z\",\n  \"updatedAt\": \"2026-05-02T10:00:42.000Z\"\n}\n```\n\nThe mapping is now permanent. `externalUserId = UA12345678` (attacker) → `globalUserId = ro_global_us_VICTIM_ADMIN_ID` (victim).\n\n---\n\n### Step 4 — Attacker impersonates victim via AI agent\n\nAttacker sends any message to the Budibase Slack bot from their own account (`UA12345678`).\n\nThe chat handler resolves the identity:\n\n```typescript\n// packages/server/src/api/controllers/webhook/chatHandler.ts:421\nconst existingLink = await sdk.ai.chatIdentityLinks.getChatIdentityLink({\n  provider: AgentChannelProvider.SLACK,\n  externalUserId: \"UA12345678\",     // ← attacker's Slack ID\n  teamId: \"T_ACME_SLACK\",\n})\n// existingLink.globalUserId = \"ro_global_us_VICTIM_ADMIN_ID\"\n\nconst linkedUser = await getGlobalUser(\"ro_global_us_VICTIM_ADMIN_ID\")\n// All agent tool calls now execute with victim admin's permissions\n```\n\nThe attacker can now ask the agent:\n\n\u003e \"Show me all rows in the Customers table\"\n\u003e \"Trigger the 'Send Invoice' automation for customer ID 42\"\n\u003e \"What files are in the knowledge base?\"\n\nEach request runs with the victim admin's identity and permissions. The victim has no indication this is happening.\n\n---\n\n### Step 3b — Variant: Victim Not Yet Authenticated\n\nIf the victim is not currently logged in when they click the URL:\n\n**HTTP Request:**\n```http\nGET /api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff HTTP/1.1\nHost: budibase.company.com\n```\n\n**HTTP Response:**\n```http\nHTTP/1.1 302 Found\nLocation: /builder/auth/login\nSet-Cookie: budibase:returnurl=%2Fapi%2Fchat-links%2Fws_abc123%2Ftok_xxxxxxxxxxxxxxxx%2Fhandoff; Path=/\n```\n\nAfter the victim logs in, the browser follows the return URL and the attack completes identically to Step 3.\n\n---\n\n---\n\n## Remediation\n\n### Minimum Fix — Add Consent Page\n\nConvert the handoff to a two-step flow:\n\n```\nGET  /api/chat-links/:instance/:token/handoff\n  → Show consent page: \"You are linking your Budibase account to\n    [externalUserName]'s Slack identity ([provider]).\n    This allows them to interact with AI agents as you. [Confirm] [Cancel]\"\n\nPOST /api/chat-links/:instance/:token/handoff  (with CSRF token)\n  → Perform the upsertChatIdentityLink() write\n```\n\nMoving the write to `POST` removes it from `publicRoutes`, making Budibase's existing CSRF middleware apply automatically.\n\n\n---\nCredits,\nVishal Kumar B\nhttps://github.com/VishaaLlKumaaRr\n\n## References\n\n- `packages/server/src/api/routes/chat.ts:22` — public route registration\n- `packages/server/src/api/controllers/ai/chatIdentityLinks.ts:61–110` — full vulnerable controller\n- `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts:135–165` — session creation (embeds attacker's externalUserId)\n- `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts:202–247` — upsertChatIdentityLink (permanent write)\n- `packages/server/src/api/controllers/webhook/chatHandler.ts:421` — identity resolution during agent message handling\n- `packages/server/src/ai/tools/budibase/automations.ts` — automation trigger capability\n- `packages/server/src/ai/tools/budibase/rows.ts` — row read/write capability\n- `packages/types/src/sdk/chatIdentityLinks.ts` — session + link type definitions\n- CWE-352: Cross-Site Request Forgery\n- CWE-284: Improper Access Control","aliases":["CVE-2026-50132"],"modified":"2026-07-21T15:15:50.446106025Z","published":"2026-06-22T23:08:23Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-06-22T23:08:23Z","nvd_published_at":"2026-06-26T21:16:34Z","cwe_ids":["CWE-284","CWE-352"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/Budibase/budibase/security/advisories/GHSA-v7j5-vc4m-723w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50132"},{"type":"WEB","url":"https://github.com/Budibase/budibase/pull/18793"},{"type":"WEB","url":"https://github.com/Budibase/budibase/commit/cf66fb45d27402bace312d85616ddd4257f3a5aa"},{"type":"PACKAGE","url":"https://github.com/Budibase/budibase"}],"affected":[{"package":{"name":"@budibase/server","ecosystem":"npm","purl":"pkg:npm/%40budibase/server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.39.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-v7j5-vc4m-723w/GHSA-v7j5-vc4m-723w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"}]}