CVE-2023-35622 Overview
CVE-2023-35622 is a Windows Domain Name System (DNS) spoofing vulnerability affecting multiple Microsoft Windows Server versions. The flaw resides in the DNS resolver components shipped with Windows Server 2008 through Windows Server 2022 23H2. A remote, unauthenticated attacker can influence DNS responses to redirect traffic or poison cached records on affected servers. The weakness maps to [CWE-290] Authentication Bypass by Spoofing and produces a high integrity impact without requiring user interaction. Microsoft addressed the issue in the December 2023 Patch Tuesday cycle.
Critical Impact
An unauthenticated attacker over the network can spoof DNS responses, corrupting name resolution for downstream clients and enabling traffic redirection to attacker-controlled hosts.
Affected Products
- Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2023-12-12 - CVE-2023-35622 published to NVD and Microsoft releases security update
- 2025-05-22 - Last updated in NVD database
Technical Details for CVE-2023-35622
Vulnerability Analysis
The vulnerability allows an attacker on the network path or able to predict transaction state to inject forged DNS responses that the Windows DNS service accepts as authoritative. Because the flaw concerns spoofing rather than memory corruption, successful exploitation does not crash the service. Instead, the resolver caches attacker-supplied records and serves them to clients that query the affected server. The result is a high impact to integrity while confidentiality and availability remain unchanged, consistent with classic cache poisoning behavior.
The affected component is exposed by default on Windows Server deployments operating the DNS Server role, which is common on Active Directory domain controllers. Compromised name resolution on a domain controller can cascade into authentication redirection, certificate validation issues, and software update tampering.
Root Cause
Microsoft classifies the issue under [CWE-290], indicating insufficient validation of the origin or contents of DNS responses. The resolver fails to enforce sufficient entropy or response binding to outbound queries, allowing a remote actor to satisfy the matching criteria for an in-flight or upcoming query. Microsoft has not published low-level technical details beyond the advisory.
Attack Vector
Exploitation requires only network access to the DNS service. No privileges, credentials, or user interaction are needed. An attacker sends crafted DNS response packets that race or match outbound queries issued by the Windows DNS resolver. When accepted, the forged record is cached and returned to subsequent queries.
Verified proof-of-concept code is not publicly available for this CVE. Refer to the Microsoft Security Update Guide for CVE-2023-35622 for vendor-supplied technical context.
Detection Methods for CVE-2023-35622
Indicators of Compromise
- DNS cache entries that resolve internal or trusted hostnames to unexpected external IP addresses.
- High volumes of unsolicited inbound DNS response packets to the Windows DNS server's source ports.
- Sudden changes in resolution for high-value records such as wpad, update servers, or domain controller SRV records.
Detection Strategies
- Enable DNS analytic and audit logging on Windows DNS servers and compare resolved answers against authoritative upstream data.
- Monitor for DNS response packets arriving without a matching outstanding query, which suggests injection attempts.
- Alert on cache entries with unusually short TTLs combined with frequent overwrites of the same record.
Monitoring Recommendations
- Forward Windows DNS Server event logs and Microsoft-Windows-DNSServer/Analytical channel data to a centralized analytics platform.
- Baseline normal external resolvers contacted by each DNS server and alert on deviations.
- Track patch level of the DNS Server role across all domain controllers and report drift continuously.
How to Mitigate CVE-2023-35622
Immediate Actions Required
- Apply the December 2023 Microsoft security update covering CVE-2023-35622 to all affected Windows Server hosts running the DNS Server role.
- Prioritize patching domain controllers and any internet-facing recursive resolvers.
- Audit recent DNS cache contents on affected servers and clear caches after patching.
Patch Information
Microsoft released fixes through the standard cumulative update channel. Consult the Microsoft Security Update Guide for CVE-2023-35622 to identify the correct KB article for each operating system build, then deploy through Windows Update, WSUS, or your patch management solution.
Workarounds
- Restrict inbound DNS traffic to the DNS Server role using host firewalls and network ACLs so only trusted clients can query the service.
- Disable recursion on authoritative-only DNS servers and configure forwarders that use DNS over TLS or trusted upstream resolvers where possible.
- Enable DNSSEC validation for zones that support it to reduce the impact of forged responses.
# Configuration example: restrict recursion and lock the cache against overwrites
Set-DnsServerRecursion -Enable $false
Set-DnsServerCache -LockingPercent 100
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
