Open Redirect in Poweradmin DNS Administration Tool

Compliance Impact

This vulnerability allows an unauthenticated attacker to perform a full account takeover without credentials by exploiting the unvalidated use of the HTTP_HOST header in authentication flows. Such unauthorized access can lead to exposure or manipulation of sensitive data.

As a result, organizations using affected versions of Poweradmin may face compliance risks with standards like GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access.

Failure to patch this vulnerability could lead to violations of confidentiality and integrity requirements mandated by these regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Poweradmin, a web-based DNS administration tool for PowerDNS server, in versions prior to 4.2.4 and 4.3.3. The issue arises because the software uses the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without validating it.

An unauthenticated attacker can exploit this by poisoning the redirect_uri sent to the Identity Provider (IdP). This causes the IdP to redirect the victim's authorization code to a server controlled by the attacker, which can lead to a full account takeover without requiring any credentials.

The vulnerability is patched in versions 4.2.4 and 4.3.3 of Poweradmin.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an unauthenticated attacker to take over user accounts without needing any credentials.

Specifically, by poisoning the redirect_uri in authentication flows, the attacker can intercept authorization codes and gain full control over affected accounts.

This can lead to unauthorized access to sensitive DNS administration functions, potentially compromising the integrity and availability of DNS services managed by Poweradmin.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Poweradmin to version 4.2.4 or 4.3.3, as these versions contain patches that fix the issue with the unvalidated HTTP_HOST header.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the improper validation of the HTTP_HOST header in Poweradmin versions prior to 4.2.4 and between 4.3.0 and 4.3.2. Detection can focus on identifying requests with manipulated or unusual HTTP_HOST headers targeting the affected authentication callback URLs (OIDC, SAML, logout flows).

To detect potential exploitation attempts on your network or system, you can monitor HTTP requests to the Poweradmin server for suspicious or unexpected HTTP_HOST header values that differ from your legitimate domain or configured base URL.

• Use network packet capture tools like tcpdump or Wireshark to filter HTTP requests with suspicious Host headers.
• Example tcpdump command to capture HTTP Host headers: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'Host:'
• Use web server access logs to search for unusual Host header values or redirect_uri parameters in URLs related to authentication flows.
• Example grep command on Apache/Nginx logs: grep -i 'Host:' /var/log/nginx/access.log | grep -v 'your-legitimate-domain.com'
• Check for unexpected redirect_uri parameters in URLs by searching logs for patterns like 'redirect_uri=' or 'callback_url=' with domains not matching your configured base URL.

Additionally, ensure your Poweradmin configuration has the interface.base_url set to enforce safe URL construction, which mitigates this vulnerability.

Useful 0 Not Useful 0