Weave Net up to 2.6.2 forwarding DNS Request dns rebinding

Summaryinfo

A vulnerability was found in Weave Net up to 2.6.2. It has been rated as critical. This issue affects some unknown processing of the file /proc/sys/net/ipv6/conf//forwarding. This manipulation as part of DNS Request causes dns rebinding. This vulnerability is registered as CVE-2020-11091. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Weave Net up to 2.6.2. It has been declared as critical. Affected by this vulnerability is an unknown function of the file /proc/sys/net/ipv6/conf//forwarding. The manipulation as part of a DNS Request leads to a dns rebinding vulnerability. The CWE definition for the vulnerability is CWE-350. The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates.

The weakness was published 06/03/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is known as CVE-2020-11091 since 03/30/2020. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1583.002 according to MITRE ATT&CK.

Upgrading to version 2.6.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Weave Net

Version

• 2.6.0
• 2.6.1
• 2.6.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion