Listen to this Post
The vulnerability exists within the cert-manager-controller’s ACME DNS-01 challenge handling. For zone discovery and propagation checks, the controller performs DNS lookups using plain, unencrypted DNS by default. A malicious actor capable of intercepting and manipulating this DNS traffic (via a Man-in-the-Middle attack on the pod’s network) can inject a specially crafted DNS record into the controller’s internal DNS cache. When cert-manager later attempts to resolve this maliciously injected cache entry, it triggers an unhandled runtime panic. This panic causes the entire cert-manager-controller pod to crash, resulting in a sustained Denial of Service (DoS) condition, halting all certificate issuance and renewal operations. The attack is also feasible if the attacker controls the authoritative DNS server for the domain undergoing validation.
Platform: cert-manager
Version: 1.18.0 to 1.19.2
Vulnerability: DNS Cache Poisoning
Severity: Critical
date:
Prediction: 2024-04-10
What Undercode Say:
Simulating DNS spoofing to inject a malicious A record sudo ettercap -T -q -M arp:remote /192.168.1.10// /192.168.1.1// echo "malicious.example.com. IN A 0.0.0.0" | nc -u -w0 192.168.1.10 53
// Simplified code snippet showing cache access without validation
func resolveFromCache(entry string) []byte {
data := cache.Get(entry) // Attacker-controlled data causes panic
return parseRR(data) // Panic occurs here on malformed data
}
How Exploit:
1. Intercept cert-manager pod’s DNS traffic.
- Forge a response with a crafted, malformed DNS record.
3. Poison the controller’s internal DNS cache.
- Trigger a lookup for the cached malicious entry.
5. Cause an unhandled panic and pod crash.
Protection from this CVE
- Upgrade to cert-manager v1.19.3+
- Upgrade to cert-manager v1.18.5+
- Implement DNS-over-HTTPS (DoH)
Impact:
- Complete controller denial-of-service
- Halted certificate issuance/renewal
- Trust compromise via DNS
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
