CVE-2024-24759 MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

What is CVE-2024-24759?

CVE-2024-24759 is a critical server-side request forgery vulnerability in mindsdb, published on 5 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.

Weakness: CWE-918

Which versions are affected by CVE-2024-24759?

3 open source packages ship an affected version, including mindsdb. It affects 1 product.

Products include Mindsdb Mindsdb.

How do I fix CVE-2024-24759?

Upgrade mindsdb to 23.12.4.2 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-24759 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24759 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in mindsdb

• CVE-2023-50731 MindsDB has arbitrary file write in file.py Critical 9.1
• CVE-2023-38699 MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue Critical 9.1
• CVE-2024-45856 MindsDB Cross-site Scripting vulnerability Critical 9.0
• CVE-2026-27483 MindsDB has Path Traversal in /api/files Leading to Remote Code Execution High 8.8
• CVE-2024-45846 MindsDB Eval Injection vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4jcv-vp96-94xr, PYSEC-2024-74.