MindsDB kwetsbaar voor omzeiling van SSRF-bescherming met DNS Rebinding

The SSRF vulnerability in mindsdb arises from insufficient validation of URLs, specifically failing to properly handle DNS rebinding attacks. DNS rebinding allows an attacker to initially resolve a domain to a public IP address and then, through subsequent DNS queries, redirect it to an internal IP address. This enables the attacker to craft requests that appear to originate from the mindsdb server, bypassing security controls and potentially accessing sensitive internal resources, such as databases, APIs, or cloud services. Successful exploitation could lead to unauthorized data access, modification, or even remote code execution depending on the internal services exposed. The impact is amplified if mindsdb is deployed in environments with strict network segmentation, as the SSRF bypass could circumvent these protections.

Organizations using mindsdb in production environments, particularly those with sensitive internal resources accessible via network services, are at risk. Deployments relying on strict network segmentation to protect internal systems are especially vulnerable, as the SSRF bypass can circumvent these controls. Users running older versions of mindsdb (≤23.9.3.1) are directly affected.

• python / server:

# Check for vulnerable mindsdb versions
ps aux | grep mindsdb | grep '23.9.3.1'

• generic web:

# Check for outbound requests to unexpected internal IPs in access logs
grep '127.0.0.1' /var/log/nginx/access.log

1. 2024-09-05Disclosure

   disclosure

1. Gereserveerd2024-01-29
2. Gepubliceerd2024-09-05
3. Gewijzigd2024-11-27
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-24759 is to upgrade mindsdb to version 23.12.4.2 or later, which includes the necessary URL validation fixes. If upgrading immediately is not feasible, consider implementing temporary workarounds. These may include restricting outbound network access from the mindsdb server to only necessary destinations using a firewall or proxy. Additionally, implement strict URL validation rules within the application code to prevent DNS rebinding attacks. Monitor network traffic for suspicious outbound requests to unexpected internal IP addresses. After upgrading, confirm the fix by attempting a DNS rebinding attack against the mindsdb instance and verifying that the request is properly blocked.