Bug 1483867 (CVE-2017-7557) - CVE-2017-7557 dnsdist: Alteration of ACLs via API authentication bypass
Summary: CVE-2017-7557 dnsdist: Alteration of ACLs via API authentication bypass
Alias: CVE-2017-7557
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1483872 1483873
TreeView+ depends on / blocked
Reported: 2017-08-22 07:33 UTC by Adam Mariš
Modified: 2021-02-17 01:42 UTC (History)
2 users (show)

Fixed In Version: dnsdist 1.2.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2019-06-08 03:21:53 UTC

Attachments (Terms of Use)

Description Adam Mariš 2017-08-22 07:33:01 UTC
An issue has been found in dnsdist 1.1.0, in the API authentication mechanism. API methods should only be available to a user authenticated via an X-API-Key HTTP header, and not to a user authenticated on the webserver via Basic Authentication, but it was discovered by Nixu during a source code audit that dnsdist 1.1.0 allows access to all API methods to both kind of users.

In the default configuration, the API does not provide access to more information than the webserver does, and therefore this issue has no security implication. However if the API is allowed to make configuration changes, via the setAPIWritable(true) option, this allows a remote unauthenticated user to trick an authenticated user into editing dnsdist’s ACLs by making him visit a crafted website containing a Cross-Site Request Forgery.



Comment 1 Adam Mariš 2017-08-22 07:33:10 UTC

Name: the PowerDNS project
Upstream: Nixu

Comment 2 Adam Mariš 2017-08-22 07:39:20 UTC
Created dnsdist tracking bugs for this issue:

Affects: epel-7 [bug 1483873]
Affects: fedora-all [bug 1483872]

Comment 3 Product Security DevOps Team 2019-06-08 03:21:53 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Note You need to log in before you can comment on or make changes to this bug.