Loading HuntDB...

DNS rebinding in --inspect via invalid octal IP address

Medium
N
Node.js
Submitted None
Reported by haxatron1

Vulnerability Details

Technical details and impact analysis

OS Command Injection
## Summary The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format. An example of an octal IP address is 1.09.0.0, the 09 octet is invalid because 9 is not a number in the base 8 number system. Browsers such as Firefox (tested on latest version m105) will still attempt to resolve this invalid octal address via DNS. When combined with an active --inspect session, such as when using VSCode, an attacker can perform DNS rebinding and execute arbitrary code ## Steps To Reproduce: 1. Add entry to /etc/hosts ``````` 127.0.0.1 1.09.0.0 ``````` 2. Start `node --inspect` 3. Visit http://1.09.0.0:9229/json on Firefox (tested on m105) 4. JSON file shows. This proves Firefox is resolving 1.09.0.0 to 127.0.0.1 via DNS. Additionally, you may use Wireshark to see that Firefox is sending DNS requests to 1.09.0.0 (without the /etc/hosts entry of course!) ## Impact Bypass the DNS rebinding protection for --inspect and execute arbitrary code

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

OS Command Injection