CVE-2024-46413
📋 TL;DR
CVE-2024-46413 is a Server-Side Request Forgery (SSRF) vulnerability in Rebuild v3.7.7 that allows attackers to make the server send HTTP requests to internal systems via the type parameter in the RBStoreController. This affects all deployments of Rebuild v3.7.7 that expose the vulnerable endpoint.
💻 Affected Systems
- Rebuild
📦 What is this software?
Rebuild by Getrebuild
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data from internal networks, or perform port scanning of internal infrastructure.
Likely Case
Information disclosure from internal services, potential access to metadata services in cloud environments, or limited internal network reconnaissance.
If Mitigated
Limited impact with proper network segmentation and egress filtering, potentially only revealing error messages or service availability.
🎯 Exploit Status
Exploitation requires understanding of the vulnerable endpoint and parameter manipulation. No public exploit code available at time of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after v3.7.7
Vendor Advisory: https://github.com/getrebuild/rebuild
Restart Required: No
Instructions:
1. Upgrade Rebuild to version after v3.7.7. 2. Verify the com.rebuild.web.admin.rbstore.RBStoreController#loadDataIndex method has proper input validation. 3. Test the fix by attempting SSRF against the patched endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the type parameter to only allow expected values
Network Segmentation
allRestrict outbound network access from the Rebuild server to only necessary services
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SSRF patterns in the type parameter
- Restrict access to the /admin/rbstore endpoint using authentication and IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Test if the /admin/rbstore endpoint accepts arbitrary URLs in the type parameter and makes external requestsCheck Version:
Check Rebuild version in application configuration or via admin interfaceVerify Fix Applied:
Attempt SSRF against the patched endpoint and verify it rejects malicious type parameter values📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Rebuild server
- Requests to internal IP addresses from the application
- Errors from the RBStoreController with unusual type parameters
Network Indicators:
- HTTP requests from Rebuild server to unexpected internal services
- Port scanning activity originating from the Rebuild server
SIEM Query:
source="rebuild-server" AND (dest_ip IN private_ranges OR dest_port_scanning=true)