PT-2024-17853 · Ruifang Tech · Ruifang-Tech Rebuild

Vastzero · Published 2024-12-27 · Updated 2024-12-28 · CVE-2024-12990

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ruifang-tech Rebuild version 3.8.6

Description A vulnerability was found in the Admin Verification Page of the affected software, specifically in the file /user/admin-verify. The issue is related to the manipulation of the nexturl argument, which can lead to an open redirect when an input like http://localhost/evil.html is used. This can be initiated remotely. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

Recommendations For version 3.8.6, consider restricting access to the /user/admin-verify page or disabling the nexturl argument to minimize the risk of exploitation until a patch is available. Avoid using the nexturl argument in the affected page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-12990

Affected Products

Ruifang-Tech Rebuild

References · 8

• 🔥 https://github.com/cydtseng/Vulnerability-Research/blob/main/rebuild/OpenRedirect-AdminVerification.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12990 · Security Note
• https://vuldb.com/?submit.464029 · Note
• https://vuldb.com/?id.289383 · Note
• https://t.me/cvedetector/13790 · Telegram Post
• https://twitter.com/CVEnew/status/1872889622549959087 · Twitter Post
• https://vuldb.com/?ctiid.289383 · Note
• https://twitter.com/VulmonFeeds/status/1872790005417910429 · Twitter Post