nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-1021 CVE-2024-1021
MEDIUMNuclei
Rebuild HTTP Request readRawText server-side request forgery
Record summary
CVE-2024-1021 has a selected CVSS score of 6.3 (medium); EIP currently links 1 Nuclei template.
Description
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Apr 4, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 21, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Rebuild | CVE List | 3.5.0 | affected |
| 3.5.1 | affected | ||
| 3.5.2 | affected | ||
| 3.5.3 | affected | ||
| 3.5.4 | affected | ||
| 3.5.5 | affected | ||
| VulnCheck | Version data not supplied | ||
Nuclei templates
1ProjectDiscoveryCRITICALRebuild <= 3.5.5 - Server-Side Request ForgeryCVSS 9.8
There is a security vulnerability in Rebuild 3.5.5, which is due to a server-side request forgery vulnerability in the URL parameter of the readRawText function of the HTTP Request Handler component.
Impact
Successful exploitation of this vulnerability can result in unauthorized access to sensitive internal resources.
Remediation
Apply the latest security patches or updates provided by Rebuild to fix this vulnerability.
WeaknessesCWE-918
AuthorsBMCel
Template tagscve2024cverebuildssrfruifang-techvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:ruifang-tech:rebuild:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:"871154672"
FOFA: icon_hash="871154672"
https://github.com/getrebuild/rebuild https://nvd.nist.gov/vuln/detail/CVE-2024-1021 https://vuldb.com/?ctiid.252290 https://vuldb.com/?id.252290 https://github.com/tanjiti/sec_profile
Source: ProjectDiscovery
References
4vuldb.comsignaturepermissions required
https://vuldb.com/?ctiid.252290 vuldb.comvdb entryTechnical description
https://vuldb.com/?id.252290 yuque.comexploit
https://www.yuque.com/mailemonyeyongjuan/tha8tr/yemvnt5uo53gfem5