Vulnerability · Published Jan 29, 2024 · Assigned by VulDB

CVE-2024-1021Rebuild HTTP Request readRawText server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in Rebuild. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 34.7% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)34.7%top 1.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Rebuild	3.5.03.5.13.5.23.5.33.5.43.5.5

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.252290 vdb-entry, technical-description
https://vuldb.com/?ctiid.252290 signature, permissions-required
https://www.yuque.com/mailemonyeyongjuan/tha8tr/yemvnt5uo53gfem5 exploit