MindsDB DNS Rebinding Bypass of SSRF Protection (CVE-2024-24759)
MindsDB's Server for Early Versions (before v23.12.4.2) contained a vulnerability that allowed attackers to bypass server-side request forgery (SSRF) protections through DNS rebinding. The vulnerability was addressed in version v23.12.4.3.
What happened
MindsDB's is_private_url() function was vulnerable to DNS rebinding attacks. The function performs an initial DNS query to check if a given URL points to a private IP address, but an attacker could manipulate DNS resolution so that the initial query returns a public IP address while a subsequent request resolves to a private IP address.
This allowed attackers to bypass server-side request forgery (SSRF) protections and access private network resources.
Index analysis
The vulnerability affected MindsDB pip package versions before v23.12.4.2 and was patched in v23.12.4.3.
Governance controls
MindsDB published a security advisory on September 5, 2024, and released a patched version v23.12.4.3 to address the DNS rebinding vulnerability.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.