Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-39713

CVE-2024-39713: Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

8.6

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-39713
GHSA ID
GHSA-ffxg-5f8m-h72j
EPSS Score
0.98985%
CWE
CWE-918
Published
8/5/2024
Updated
8/30/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
rocket.chatnpm< 6.10.16.10.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing SSRF protections in URL fetching operations. The commit adds a new checkUrlForSsrf.ts module and modifies these functions to implement DNS resolution checks, IP range validation, and domain restrictions. The affected functions handled user-supplied URLs for avatars and SMS attachments without validating if the target URLs resolved to internal/restricted network resources. The high confidence comes from the direct correlation between the vulnerability description ('Twilio webhook SSRF') and the patched file paths related to external resource fetching.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* S*rv*r-Si** R*qu*st *or**ry (SSR*) *****ts Ro*k*t.***t's Twilio w***ook *n*point ***or* v*rsion *.**.*.

Reasoning

T** vuln*r**ility st*ms *rom missin* SSR* prot**tions in URL **t**in* op*r*tions. T** *ommit ***s * n*w `****kUrl*orSsr*.ts` mo*ul* *n* mo*i*i*s t**s* *un*tions to impl*m*nt *NS r*solution ****ks, IP r*n** v*li**tion, *n* *om*in r*stri*tions. T** ***