CVE-2024-39713 Overview
CVE-2024-39713 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Rocket.Chat versions prior to 6.10.1. The flaw resides in the Twilio webhook endpoint, which fails to properly validate user-supplied URLs before initiating outbound HTTP requests. Attackers can abuse the endpoint to coerce the Rocket.Chat server into sending requests to internal network resources or arbitrary external destinations. The vulnerability is exploitable over the network without authentication or user interaction, producing a scope change that impacts resources beyond the vulnerable component.
Critical Impact
Unauthenticated attackers can pivot through Rocket.Chat servers to reach internal services, cloud metadata endpoints, and other resources unreachable from the public internet.
Affected Products
- Rocket.Chat versions prior to 6.10.1
- Self-hosted Rocket.Chat deployments exposing the Twilio webhook endpoint
- Cloud-hosted Rocket.Chat instances running affected versions
Discovery Timeline
- 2024-08-05 - CVE-2024-39713 published to NVD
- 2024-09-06 - Last updated in NVD database
Technical Details for CVE-2024-39713
Vulnerability Analysis
The vulnerability is classified under [CWE-918] Server-Side Request Forgery. Rocket.Chat exposes a webhook endpoint to receive callbacks from Twilio for SMS and voice integrations. The endpoint processes parameters that influence outbound HTTP requests issued by the server. Because the endpoint does not enforce strict allowlists on destination hosts or schemes, an attacker can craft requests that force the Rocket.Chat backend to fetch attacker-chosen URLs.
The Exploit Prediction Scoring System places this issue in the top percentile of likely-exploited vulnerabilities, reflecting the simplicity and impact of SSRF against widely deployed collaboration platforms.
Root Cause
The root cause is insufficient validation of URL inputs handled by the Twilio webhook route. The endpoint accepts attacker-controlled values that are passed into a server-side HTTP client without filtering loopback ranges, private RFC1918 networks, link-local addresses, or cloud metadata endpoints such as 169.254.169.254. The lack of an allowlist combined with unauthenticated access converts a standard integration endpoint into a request proxy.
Attack Vector
An unauthenticated attacker sends an HTTP request to the vulnerable Twilio webhook on a public-facing Rocket.Chat instance. The crafted payload directs the server to issue an outbound HTTP request to an internal host. Typical SSRF targets include cloud instance metadata services, internal admin consoles, Kubernetes API servers, database management interfaces, and Redis or Elasticsearch instances bound to internal addresses. Successful exploitation can expose credentials, tokens, and internal topology used in follow-on attacks.
No public proof-of-concept code is available. Refer to the HackerOne Security Report #1886954 for technical disclosure details.
Detection Methods for CVE-2024-39713
Indicators of Compromise
- Outbound HTTP requests originating from the Rocket.Chat server process targeting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or 169.254.169.254
- Unusual access patterns on the Twilio webhook endpoint from IPs not associated with Twilio's published ranges
- Server logs showing webhook payloads containing URLs pointing to localhost, loopback, or internal hostnames
Detection Strategies
- Inspect Rocket.Chat reverse proxy logs for unauthenticated POST requests to Twilio webhook paths followed by anomalous egress traffic
- Correlate Rocket.Chat process network telemetry against expected Twilio API destinations to surface SSRF attempts
- Apply web application firewall rules that flag webhook payloads referencing internal address space or metadata service hostnames
Monitoring Recommendations
- Enable egress filtering and log all outbound connections initiated by the Rocket.Chat server for retroactive analysis
- Alert on any Rocket.Chat container or host issuing requests to cloud metadata IPs or internal management interfaces
- Forward Rocket.Chat access logs and host network flows to a centralized SIEM for cross-source correlation
How to Mitigate CVE-2024-39713
Immediate Actions Required
- Upgrade Rocket.Chat to version 6.10.1 or later on all self-hosted and managed deployments
- Restrict public exposure of the Twilio webhook endpoint to known Twilio source IP ranges using a reverse proxy or WAF
- Audit recent webhook traffic and outbound server requests for signs of exploitation prior to patching
Patch Information
Rocket.Chat addressed the vulnerability in version 6.10.1. Administrators should apply the upgrade following the vendor's standard release procedure. Disclosure details are documented in the HackerOne Security Report #1886954.
Workarounds
- Block the Twilio webhook route at the reverse proxy if the Twilio integration is not in use
- Enforce IMDSv2 on AWS workloads to mitigate cloud metadata theft through SSRF
- Place Rocket.Chat in a network segment with strict egress controls that deny traffic to internal management subnets and metadata endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
