DNS rebinding in --inspect via invalid octal IP address
Medium
N
Node.js
Submitted None
Actions:
Reported by
haxatron1
Vulnerability Details
Technical details and impact analysis
## Summary
The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format.
An example of an octal IP address is 1.09.0.0, the 09 octet is invalid because 9 is not a number in the base 8 number system.
Browsers such as Firefox (tested on latest version m105) will still attempt to resolve this invalid octal address via DNS. When combined with an active --inspect session, such as when using VSCode, an attacker can perform DNS rebinding and execute arbitrary code
## Steps To Reproduce:
1. Add entry to /etc/hosts
```````
127.0.0.1 1.09.0.0
```````
2. Start `node --inspect`
3. Visit http://1.09.0.0:9229/json on Firefox (tested on m105)
4. JSON file shows. This proves Firefox is resolving 1.09.0.0 to 127.0.0.1 via DNS. Additionally, you may use Wireshark to see that Firefox is sending DNS requests to 1.09.0.0 (without the /etc/hosts entry of course!)
## Impact
Bypass the DNS rebinding protection for --inspect and execute arbitrary code
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
OS Command Injection