Listen to this Post
How CVE works: The vulnerability exists in Hickory DNS experimental hickory-recursor crate’s DnsLru cache. The cache stores DNS response records keyed by each record’s own (name, type) instead of the original query. The function cache_response() chains ANSWER, AUTHORITY, and ADDITIONAL sections into one iterator before insertion. The bailiwick filter uses the zone context of the NS pool that serviced the lookup, not the queried zone. When building NS pool for attacker.poc., Hickory uses parent poc. NS pool (ns.zone() = “poc.”). An attacker-controlled poc. nameserver can inject into AUTHORITY section a record for sibling zone victim.poc. NS ns.evil.poc. The bailiwick check is_subzone(“poc.”, “victim.poc.”) passes because victim.poc. is a subdomain of poc. Thus the NS record is stored under (victim.poc., NS) in shared cache. Later any client querying a name under victim.poc. retrieves poisoned NS entry, routing queries to attacker’s ns.evil.poc. instead of legitimate nameserver. Legitimate NS receives zero queries. Fix in hickory-resolver 0.26.0 with recursor feature changes to response-level caching keyed by originating query (name, type). Response to (attacker.poc., NS) stored only under that key, cannot affect (victim.poc., NS) entry. Issue present in all published hickory-recursor versions. Crate folded into hickory-resolver under non-default recursor flag. No updates for hickory-recursor; migrate to hickory-resolver 0.26.0+ with recursor feature. Discovered by Qifan Zhang, Palo Alto Networks.
dailycve form:
Platform: Hickory DNS recursor
Version: all published versions
Vulnerability: Cross-zone DNS poisoning
Severity: High
date: Not specified
Prediction: Patched in 0.26.0
What Undercode Say:
Check if using vulnerable hickory-recursor crate grep -E "hickory-recursor[[:space:]]=[[:space:]]\"[0-9]" Cargo.toml Verify recursor feature enabled in hickory-dns binary grep -E "recursor[[:space:]]=[[:space:]]true" config.toml Example cache dump (requires debug build) to inspect poisoned NS entries echo "show cache" | hickory-dns -c config.toml --interactive Test for vulnerability by querying sibling zone after malicious response dig @recursor victim.poc. NS +short
Exploit:
Attacker controls poc. nameserver; returns legitimate response plus poisoned AUTHORITY section adding NS for victim.poc. pointing to attacker’s NS. Subsequent queries for victim.poc. use poisoned cache, enabling DNS hijacking.
Protection from this CVE:
Upgrade to hickory-resolver 0.26.0+ with recursor feature enabled. If using hickory-recursor directly, migrate to hickory-resolver. Disable recursor feature until upgrade. Deploy response policy zones (RPZ) to override poisoned NS entries.
Impact:
Full redirection of all queries for victim domain to attacker’s nameserver. Allows phishing, man-in-the-middle, and cache poisoning across sibling zones. Affects any recursive resolver using vulnerable crate.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
