CVE-2018-14663 in dnsdist
Summary
by MITRE
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/11/2023
The vulnerability identified as CVE-2018-14663 represents a critical security flaw in PowerDNS DNSDist versions prior to 1.3.3 that enables remote attackers to bypass DNS filtering mechanisms through carefully crafted DNS queries containing trailing data. This vulnerability specifically targets the handling of DNS records when dnsdist acts as a DNS firewall, creating a scenario where malicious data can be smuggled to backend servers while remaining undetected by the filtering layer. The issue manifests when dnsdist processes DNS queries that include additional data beyond the standard DNS record structure, particularly affecting configurations that utilize the 'useClientSubnet' or experimental 'addXPF' parameters for backend server declarations. The flaw stems from improper parsing and forwarding mechanisms that fail to properly validate or strip trailing data from DNS packets before transmission to backend servers.
The technical implementation of this vulnerability involves the manipulation of DNS query packets where attackers append extra data following legitimate DNS records. When dnsdist encounters a query requiring EDNS Client Subnet functionality or XPF record handling, it processes the packet and attempts to add additional records such as OPT records to support these features. However, the software's packet parsing logic does not adequately sanitize the packet structure, allowing trailing data that follows the legitimate DNS record content to be preserved and forwarded to backend servers. This creates a situation where the trailing data, which may contain malicious records or data that should be filtered out, bypasses dnsdist's filtering mechanisms entirely while still being accepted by backend servers that process the complete packet including the trailing information.
The operational impact of this vulnerability is particularly severe for organizations relying on dnsdist as a security layer for DNS traffic filtering and protection. When deployed as a DNS firewall, dnsdist is expected to inspect and filter incoming DNS queries to prevent potentially harmful traffic from reaching backend DNS servers. However, this vulnerability allows attackers to craft queries that appear legitimate to dnsdist's filtering system while simultaneously injecting malicious data that reaches the backend servers. The risk is amplified when the 'useClientSubnet' parameter is enabled, as this functionality is commonly used in production environments to support modern DNS features like EDNS Client Subnet. The experimental 'addXPF' parameter adds additional complexity to the attack surface, making this vulnerability exploitable in a broader range of deployment scenarios. This weakness essentially undermines the security posture of dnsdist deployments by creating a tunnel through which filtered traffic can pass undetected.
Organizations should immediately implement mitigation strategies to address this vulnerability, with the primary recommendation being the upgrade to PowerDNS DNSDist version 1.3.3 or later where the issue has been resolved through improved packet validation and sanitization mechanisms. The fix implemented in version 1.3.3 addresses the core parsing issue by ensuring that trailing data in DNS packets is properly identified and removed before forwarding to backend servers, regardless of whether 'useClientSubnet' or 'addXPF' parameters are active. Additionally, network administrators should consider implementing additional monitoring and logging to detect unusual patterns in DNS traffic that might indicate exploitation attempts. The vulnerability aligns with CWE-129, which addresses improper validation of input length, and relates to ATT&CK technique T1071.004 for application layer protocol: DNS, as it exploits weaknesses in DNS protocol handling to bypass security controls. Security teams should also review their current dnsdist configurations to identify any active use of the vulnerable parameters and ensure proper patching across all affected systems in their infrastructure.