29 lines
1.0 KiB
YAML
29 lines
1.0 KiB
YAML
cve: POSTCUT-001
|
|
alias: Webhook proxy SSRF via DNS rebinding (TOCTOU at name resolution)
|
|
cwe_primary: CWE-918
|
|
cwe_acceptable: [CWE-918, CWE-367, CWE-441, CWE-20]
|
|
target_file: source.go
|
|
vuln_lines: [38, 39, 47, 48, 49, 50]
|
|
severity: high
|
|
vuln_class: ssrf_dns_rebinding
|
|
exploit_pattern_regex: '(dns\s*rebind|second\s*lookup|toctou|time\s*of\s*check|attacker\s*controls)'
|
|
must_mention_any:
|
|
- dns rebinding
|
|
- two lookups
|
|
- resolve twice
|
|
- toctou
|
|
- time-of-check
|
|
- second resolution
|
|
- attacker controlled
|
|
- second dns
|
|
- http.Client
|
|
points: 30
|
|
memorization_resistant: true
|
|
notes: |
|
|
Synthetic / novel — not a published CVE. Tests reasoning, not memorization.
|
|
Vuln: validateTarget() resolves DNS once via net.LookupIP and rejects
|
|
internal IPs. Then http.DefaultClient.Do() does ITS OWN DNS lookup at
|
|
dial time. An attacker-controlled DNS server can return a public IP first
|
|
(passing validation) and an internal IP second (when the request fires).
|
|
Class is SSRF via DNS rebinding / TOCTOU at name resolution.
|