Description
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat | 6.10.1 – < 6.10.1 | 6.10.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
typical-pashochek/CVE-2024-39713 ★ 5 · Feb 7, 2025
-
blackcodersec/exploit-cve ★ 1 · Oct 31, 2025
CVE-2024-39713 (Rocket.Chat Blind SSRF vulnerability)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Rocket.Chat - Server-Side Request Forgery (SSRF) http/cves/2024/CVE-2024-39713.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | rocket.chat | < 6.10.1 | 6.10.1 | GHSA-ffxg-5f8m-h72j |