zakirkun DNS Rebinding Vulnerability
Overview
DNS rebinding allows an attacker to bypass Same-Origin Policy and IP allowlists. The attack works by:
- Victim visits attacker's page at
evil.com - Attacker's DNS TTL expires;
evil.comresolves to127.0.0.1 - JavaScript makes requests to
evil.comwhich now reach the victim's localhost services - Services that only check the IP (not the Host header) are bypassed
Vulnerable applications that check Host header or resolve hostname for validation without proper binding.
Detection Strategy
- URL validation that checks hostname string rather than resolved IP
- HTTP servers binding to all interfaces without Host header validation
- SSRF protection based on DNS resolution rather than allowlist