Description
Rocket.Chat是Meteor Development Group开发的开源团队协作平台，提供实时聊天、文件分享、视频会议、语音消息等功能，广泛应用于企业团队协作和客户服务场景。该产品在6.10.1之前的版本中，/api/v1/livechat/sms-incoming/twilio接口存在服务器端请求伪造漏洞，攻击者可构造恶意Twilio webhook请求使服务器向内网或外部任意地址发送HTTP请求。
Rocket.Chat /api/v1/livechat/sms-incoming/twilio 服务器端请求伪造漏洞（CVE-2024-39713）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-39713
https://hackerone.com/reports/1886954
https://github.com/advisories/GHSA-ffxg-5f8m-h72j
https://www.cve.org/CVERecord?id=CVE-2024-39713
https://www.cvedetails.com/cve/CVE-2024-39713/
https://darkwebinformer.com/cve-2024-39713-rocket-chat-ssrf-poc/
https://advisories.gitlab.com/npm/rocket.chat/CVE-2024-39713/
https://avd.aquasec.com/nvd/2024/cve-2024-39713/
https://www.wiz.io/vulnerability-database/cve/cve-2024-39713