Listen to this Post
The CVE-2024-34096 vulnerability is a DNS rebinding attack against the SillyTavern web UI. An attacker registers a domain name and configures it with a very short Time-To-Live (TTL) DNS record that initially points to the attacker’s own server. A victim user visits the malicious domain, and their browser executes JavaScript code from this location. After the initial connection, the attacker’s DNS server rebinds the domain name to resolve to an internal IP address, typically 127.0.0.1 (localhost). Because the browser’s same-origin policy is based on the hostname and not the underlying IP, the malicious script running in the victim’s browser is now permitted to make fetch requests to the local SillyTavern instance running on http://127.0.0.1:8000. This bypasses CORS and allows the attacker’s remote code to interact with the local application as if it were the user, enabling data theft and system manipulation.
Platform: SillyTavern
Version: <1.13.4
Vulnerability: DNS Rebinding
Severity: Critical
date: 2024-06-11
Prediction: Patched in v1.13.4
What Undercode Say:
nslookup malicious.rebind.attacker curl -I http://127.0.0.1:8000/
fetch("http://localhost:8000/api/chats");
config.yaml hostWhitelist: enabled: true list: ["localhost", "127.0.0.1"]
How Exploit:
Visiting malicious site.
DNS record rebinds to 127.0.0.1.
JavaScript fetches local SillyTavern.
Bypasses CORS policy.
Performs unauthorized actions.
Protection from this CVE
Enable hostWhitelist.
Update to v1.13.4.
Use SSL/TLS.
Impact:
Read private chats.
Install malicious extensions.
HTML injection phishing.
Full system control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
