CVE-2024-24759: MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

DNS rebinding is a method of manipulating resolution of domain names to let the initial DNS query hits an address and the second hits another one. For instance the host make-190.119.176.200-rebind-127.0.0.1-rr.1u.ms would be initially resolved to 190.119.176.200 and the next DNS issue to 127.0.0.1. Please notice the following in the latest codebase:

def is_private_url(url: str):
"""
Raises exception if url is private

:param url: url to check
"""

hostname = urlparse(url).hostname
if not hostname: