Reliance on Reverse DNS Resolution for a Security-Critical Action in wiremock and python-wiremock - CVE-2023-41329

Detailed vulnerability description

The vulnerability allows a remote privileged user to execute arbitrary code on the target system.

The vulnerability exists due to proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to the DNS rebinding attacks. A remote privileged user can pass specially crafted data to the application, trigger the vulnerability and execute arbitrary code on the target system.

How to mitigate CVE-2023-41329

Sources

• https://github.com/wiremock/wiremock/security/advisories/GHSA-pmxq-pj47-j8j4
• https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses