CWE-350
Reliance on Reverse DNS Resolution for a Security-Critical Action
Monthly
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web page reach a victim's loopback MCP endpoint while preserving an attacker-controlled Host and Origin, so the request is accepted at the HTTP boundary and reaches the MCP initialization path - and, where a GitLab token is configured, can drive GitLab API tool calls through the victim's browser. Exploitation is network-reachable with no attacker credentials required (CVSS PR:N) but hinges on victim interaction (UI:R): the user must browse to an attacker-controlled page while an unpatched server listens on its default 127.0.0.1 bind with no effective Host/Origin allowlist. Publicly available exploit code exists - the vendor advisory ships a proof-of-concept reproduction - and the upstream/NVD vector scores 9.6 Critical, while the independent assessment lowers availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); in REMOTE_AUTHORIZATION=true deployments, token checks block material unauthenticated GitLab API tool calls, reducing realized impact to the HTTP-boundary/initialization failure.
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.
Host header injection in Grav CMS before 3.9.2 allows attackers to poison outgoing invitation emails, replacing the legitimate site URL with an attacker-controlled domain in token-bearing links sent via the sendInvitationEmail() function. The vulnerability exploits a gap in Grav's existing Host header defenses: the require_trusted_host protection was applied only to password reset flows, leaving invitation emails without equivalent validation. When a poisoned invitation email is delivered and the recipient clicks the link, the one-time invitation token is transmitted to the attacker's server rather than the legitimate site. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the reported CVSS 4.0 score of 8.7 reflects high confidentiality risk from token capture.
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the default `allow_private_network=False` restriction and reach internal services. The vulnerability affects versions prior to 0.63.0, where a time-of-check/time-of-use gap between URL validation and connection enables rebinding to private IPs. A public proof-of-concept exists, though no active exploitation in the wild is reported at this time.
Jenkins versions 2.442 through 2.554 and LTS 2.426.3 through 2.541.2 contain an origin validation bypass vulnerability in the CLI WebSocket endpoint that allows attackers to conduct DNS rebinding attacks. The vulnerability stems from improper use of Host and X-Forwarded-Host headers to compute expected request origins, enabling attackers to bypass authentication controls and potentially execute arbitrary commands through the CLI WebSocket interface. While no CVSS score, EPSS data, or active exploitation in the wild (KEV) status has been publicly disclosed, the vulnerability affects a critical Jenkins component and was responsibly disclosed by the Jenkins security team.
CleanTalk Anti-Spam WordPress plugin has an authorization bypass enabling unauthenticated attackers to perform file operations on the WordPress server.
Outbound request validation bypass via DNS rebinding in Chartbrew before 5.2.2 allows an authenticated user who can create or test API/data-source connections, and who controls DNS for the target hostname, to make the server reach internal services, localhost resources, or cloud metadata endpoints. The server validates the hostname with validateOutboundUrl() but the actual connection is performed by request-promise using an independent DNS lookup, so a public address can be returned during validation and a private address during the request. No public exploit identified at time of analysis; exploitation requires a credentialed account and attacker-controlled DNS plus winning the race between the two lookups, so real-world risk is moderate rather than high.
Bypass of rDNS-based security controls in BunkerWeb prior to 1.6.13 allows unauthenticated remote attackers who control a PTR record to spoof trusted reverse DNS suffixes, circumventing the blacklist, greylist, and antibot modules. The root cause (CWE-350) is the failure to perform forward-confirmed reverse DNS (FCrDNS) validation - affected modules checked only that the PTR hostname suffix matched a trusted pattern without verifying the hostname resolves back to the client IP. No public exploit or CISA KEV listing has been identified; vendor-released patch version 1.6.13 is available.
SSRF protection in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) is bypassable via DNS rebinding against the `/admin/gateways/test` endpoint, allowing an attacker with a database-backed `gateways.read` role to reach cloud instance metadata services (including 169.254.169.254) and internal network resources. The root cause is a TOCTOU race between the hostname validation step - which resolves DNS via `socket.getaddrinfo()` and checks the result against blocked private ranges - and the `httpx`-based HTTP client's fully independent DNS re-resolution at connection time, with no IP-pinning or validated-address forwarding bridging the two operations. A detailed proof-of-concept is published in GitHub Security Advisory GHSA-9hgc-g3w5-67cm; the vendor confirmed the fix in release v1.0.3 (2026-06-10); no CISA KEV listing is present at time of analysis.
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web page reach a victim's loopback MCP endpoint while preserving an attacker-controlled Host and Origin, so the request is accepted at the HTTP boundary and reaches the MCP initialization path - and, where a GitLab token is configured, can drive GitLab API tool calls through the victim's browser. Exploitation is network-reachable with no attacker credentials required (CVSS PR:N) but hinges on victim interaction (UI:R): the user must browse to an attacker-controlled page while an unpatched server listens on its default 127.0.0.1 bind with no effective Host/Origin allowlist. Publicly available exploit code exists - the vendor advisory ships a proof-of-concept reproduction - and the upstream/NVD vector scores 9.6 Critical, while the independent assessment lowers availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); in REMOTE_AUTHORIZATION=true deployments, token checks block material unauthenticated GitLab API tool calls, reducing realized impact to the HTTP-boundary/initialization failure.
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.
Host header injection in Grav CMS before 3.9.2 allows attackers to poison outgoing invitation emails, replacing the legitimate site URL with an attacker-controlled domain in token-bearing links sent via the sendInvitationEmail() function. The vulnerability exploits a gap in Grav's existing Host header defenses: the require_trusted_host protection was applied only to password reset flows, leaving invitation emails without equivalent validation. When a poisoned invitation email is delivered and the recipient clicks the link, the one-time invitation token is transmitted to the attacker's server rather than the legitimate site. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the reported CVSS 4.0 score of 8.7 reflects high confidentiality risk from token capture.
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the default `allow_private_network=False` restriction and reach internal services. The vulnerability affects versions prior to 0.63.0, where a time-of-check/time-of-use gap between URL validation and connection enables rebinding to private IPs. A public proof-of-concept exists, though no active exploitation in the wild is reported at this time.
Jenkins versions 2.442 through 2.554 and LTS 2.426.3 through 2.541.2 contain an origin validation bypass vulnerability in the CLI WebSocket endpoint that allows attackers to conduct DNS rebinding attacks. The vulnerability stems from improper use of Host and X-Forwarded-Host headers to compute expected request origins, enabling attackers to bypass authentication controls and potentially execute arbitrary commands through the CLI WebSocket interface. While no CVSS score, EPSS data, or active exploitation in the wild (KEV) status has been publicly disclosed, the vulnerability affects a critical Jenkins component and was responsibly disclosed by the Jenkins security team.
CleanTalk Anti-Spam WordPress plugin has an authorization bypass enabling unauthenticated attackers to perform file operations on the WordPress server.
Outbound request validation bypass via DNS rebinding in Chartbrew before 5.2.2 allows an authenticated user who can create or test API/data-source connections, and who controls DNS for the target hostname, to make the server reach internal services, localhost resources, or cloud metadata endpoints. The server validates the hostname with validateOutboundUrl() but the actual connection is performed by request-promise using an independent DNS lookup, so a public address can be returned during validation and a private address during the request. No public exploit identified at time of analysis; exploitation requires a credentialed account and attacker-controlled DNS plus winning the race between the two lookups, so real-world risk is moderate rather than high.
Bypass of rDNS-based security controls in BunkerWeb prior to 1.6.13 allows unauthenticated remote attackers who control a PTR record to spoof trusted reverse DNS suffixes, circumventing the blacklist, greylist, and antibot modules. The root cause (CWE-350) is the failure to perform forward-confirmed reverse DNS (FCrDNS) validation - affected modules checked only that the PTR hostname suffix matched a trusted pattern without verifying the hostname resolves back to the client IP. No public exploit or CISA KEV listing has been identified; vendor-released patch version 1.6.13 is available.
SSRF protection in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) is bypassable via DNS rebinding against the `/admin/gateways/test` endpoint, allowing an attacker with a database-backed `gateways.read` role to reach cloud instance metadata services (including 169.254.169.254) and internal network resources. The root cause is a TOCTOU race between the hostname validation step - which resolves DNS via `socket.getaddrinfo()` and checks the result against blocked private ranges - and the `httpx`-based HTTP client's fully independent DNS re-resolution at connection time, with no IP-pinning or validated-address forwarding bridging the two operations. A detailed proof-of-concept is published in GitHub Security Advisory GHSA-9hgc-g3w5-67cm; the vendor confirmed the fix in release v1.0.3 (2026-06-10); no CISA KEV listing is present at time of analysis.