Bunkerweb
Monthly
Bypass of rDNS-based security controls in BunkerWeb prior to 1.6.13 allows unauthenticated remote attackers who control a PTR record to spoof trusted reverse DNS suffixes, circumventing the blacklist, greylist, and antibot modules. The root cause (CWE-350) is the failure to perform forward-confirmed reverse DNS (FCrDNS) validation - affected modules checked only that the PTR hostname suffix matched a trusted pattern without verifying the hostname resolves back to the client IP. No public exploit or CISA KEV listing has been identified; vendor-released patch version 1.6.13 is available.
Privilege escalation in BunkerWeb's UI and API allows a low-privileged authenticated user to inject attacker-controlled Datalog facts into signed Biscuit authorization tokens by manipulating the HTTP Host header, which was interpolated directly into the token builder string without parameterization. Affected are BunkerWeb open-source versions prior to 1.6.12 and BunkerWeb PRO prior to 0.57. No public exploit identified at time of analysis, but the public commit diff fully documents the injection mechanism, making reproduction straightforward for any authenticated low-privileged account holder.
Improper authorization in BunkerWeb's web UI middleware allows authenticated reader-role accounts to permanently delete WAF job cache files in versions 1.6.2 through 1.6.11. The BiscuitMiddleware bypass list incorrectly included the `/cache/` URL prefix, causing the `POST /cache/delete` route to skip Biscuit role-based access control and enforce only Flask's `@login_required` decorator, making write-privileged cache operations accessible to any authenticated user. Deleted cache can include blacklists, GeoIP data, ModSecurity CRS rules, CrowdSec data, and ACME/Let's Encrypt certificate material, degrading WAF protective capability. No public exploit is identified at time of analysis; vendor-released patch is available in version 1.6.12.
Bypass of rDNS-based security controls in BunkerWeb prior to 1.6.13 allows unauthenticated remote attackers who control a PTR record to spoof trusted reverse DNS suffixes, circumventing the blacklist, greylist, and antibot modules. The root cause (CWE-350) is the failure to perform forward-confirmed reverse DNS (FCrDNS) validation - affected modules checked only that the PTR hostname suffix matched a trusted pattern without verifying the hostname resolves back to the client IP. No public exploit or CISA KEV listing has been identified; vendor-released patch version 1.6.13 is available.
Privilege escalation in BunkerWeb's UI and API allows a low-privileged authenticated user to inject attacker-controlled Datalog facts into signed Biscuit authorization tokens by manipulating the HTTP Host header, which was interpolated directly into the token builder string without parameterization. Affected are BunkerWeb open-source versions prior to 1.6.12 and BunkerWeb PRO prior to 0.57. No public exploit identified at time of analysis, but the public commit diff fully documents the injection mechanism, making reproduction straightforward for any authenticated low-privileged account holder.
Improper authorization in BunkerWeb's web UI middleware allows authenticated reader-role accounts to permanently delete WAF job cache files in versions 1.6.2 through 1.6.11. The BiscuitMiddleware bypass list incorrectly included the `/cache/` URL prefix, causing the `POST /cache/delete` route to skip Biscuit role-based access control and enforce only Flask's `@login_required` decorator, making write-privileged cache operations accessible to any authenticated user. Deleted cache can include blacklists, GeoIP data, ModSecurity CRS rules, CrowdSec data, and ACME/Let's Encrypt certificate material, degrading WAF protective capability. No public exploit is identified at time of analysis; vendor-released patch is available in version 1.6.12.