A critical vulnerability in the getrebuild/rebuild interceptor logic allows unauthenticated remote attackers to bypass security controls and compromise the application.

The flaw resides in the com.rebuild.web.RebuildWebInterceptor class, specifically within the preHandle function. The use of CodecUtils in the filter chain fails to adequately secure the request path, allowing unauthenticated attackers to bypass intended authentication or authorization checks.

With a CVSS score of 9.8, this vulnerability poses a severe threat to data integrity and confidentiality. An attacker could potentially bypass authentication mechanisms to gain unauthorized administrative access, leading to full system compromise and the exposure of sensitive data processed by the Rebuild platform.

Immediate Action: Update to the latest version of the getrebuild/rebuild software as soon as it becomes available to address the flawed interceptor logic.

Proactive Monitoring: Review web server and application access logs for unusual request patterns, particularly those targeting the preHandle interceptor path.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block suspicious requests directed at the web application, specifically filtering for unauthorized access attempts to protected resources.

Public Exploit Available: Unknown

This vulnerability represents a significant security oversight in the application's core request filtering. Security teams must prioritize applying the latest vendor patches to remediate the authentication bypass risk and prevent unauthorized access to the environment.