Listen to this Post
Intro
The vulnerability exploits a flaw in CodeWhale’s DNS-pinning logic, allowing an attacker to bypass Server-Side Request Forgery (SSRF) mitigations. The core issue is a Time-of-Check to Time-of-Use (TOCTOU) race condition in DNS resolution. During the initial request (ToC), CodeWhale resolves the domain via a DNS query. The attacker controls a custom DNS server that deliberately fails the first few queries (e.g., returns NXDOMAIN or timeouts). CodeWhale’s code assumes that if the DNS fails, the request is inherently invalid or that subsequent attempts will also fail, so it proceeds without blocking the final HTTP request. On the secondary attempt (ToU), the same DNS server now resolves the domain to a local IP (e.g., 127.0.0.1). The request is then executed against that internal address, granting access to local services, internal network resources, or cloud metadata endpoints. This bypasses all SSRF filters that only check the initial resolved IP. The vulnerability is present because the DNS-pinning mechanism does not re-validate the final IP address after a failure, allowing a malicious resolver to supply different responses for the same domain at different times. The proof-of-concept demonstrates this with a custom DNS resolver that cycles through failures and successes based on query count, and a Dockerized environment to test the attack with CodeWhale’s agent.
DailyCVE Form:
Platform: CodeWhale
Version: < 0.8.64
Vulnerability: SSRF Bypass
Severity: High
date: N/A (patch released)
Prediction: Immediate upgrade (patched)
What Undercode Say:
Analytics:
- TOCTOU exploitation via controlled DNS.
- Bypasses IP-based SSRF filters.
- Requires attacker-controlled DNS.
- Affects internal service exposure.
Bash commands to verify patch:
Check CodeWhale version codewhale --version Verify commit fix git show 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e Test DNS resolver logs sudo docker logs -f dns-resolver
Exploit: (Educational Purposes!)
1. Run custom DNS resolver (`dnser/dns_resolver.py`).
2. Configure agent to use resolver (`docker-compose.yml`).
- Start container and attach:
sudo docker attach tui. - Trigger fetch_url for `http://mydomain.com`.
- Observe resolver fails first 2 queries, allows 3rd/4th.
6. Request resolves to 127.0.0.1, accessing local service.
Protection:
- Upgrade to CodeWhale v0.8.64 or later.
- Apply DNS pinning with strict re-validation.
- Block external DNS response manipulation.
- Use egress firewalls to limit outbound DNS.
Impact:
- Exposure of internal services.
- Access to cloud metadata (e.g., AWS IMDS).
- Potential lateral movement within private networks.
- Credential theft from local/cloud services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
