GHSA-vrv5-968r-5ggm: Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion
DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.
Event History
Frequently Asked Questions
Which Hickory DNS components and versions are affected?
The issue affects hickory-net from 0.26.0-beta.1 before 0.26.2, and hickory-proto through 0.26.0-alpha.1.
What must an attacker provide to bypass validation?
The attacker must target a query that should produce NODATA in a zone containing wildcard records. They can combine an NSEC3 record matching the queried name with a signed wildcard record to create a bogus positive response accepted by validation.
What is the validation failure?
The affected validation logic does not distinguish a NODATA response from a positive response created through wildcard expansion. This allows the crafted wildcard-expanded response to be accepted as valid.