Description
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Rebuild | 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Rebuild <= 3.5.5 - Server-Side Request Forgery http/cves/2024/CVE-2024-1021.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://vuldb.com/?id.252290 vdb-entry technical-description
- https://vuldb.com/?ctiid.252290 signature permissions-required
- https://www.yuque.com/mailemonyeyongjuan/tha8tr/yemvnt5uo53gfem5 exploit