CVE-2024-25638: dnsjava DNS Cache Poisoning Vulnerability

CVE-2024-25638 Overview

CVE-2024-25638 is a DNS response validation vulnerability in dnsjava, a widely-used Java implementation of the Domain Name System (DNS) protocol. The vulnerability stems from insufficient verification of DNS reply records, where records are not checked for their relevance to the original query. This flaw allows an attacker to inject Resource Records (RRs) from different DNS zones into responses, potentially leading to cache poisoning attacks and DNS spoofing scenarios.

Critical Impact

Attackers can exploit this vulnerability to inject malicious DNS records from unrelated zones into responses, enabling DNS cache poisoning attacks that could redirect users to malicious servers, intercept sensitive communications, or facilitate man-in-the-middle attacks.

Affected Products

• dnsjava versions prior to 3.6.0
• Applications and services using vulnerable dnsjava library versions
• Java applications implementing DNS functionality via dnsjava

Discovery Timeline

• 2024-07-22 - CVE-2024-25638 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-25638

Vulnerability Analysis

This vulnerability is classified under CWE-345 (Insufficient Verification of Data Authenticity). The core issue lies in dnsjava's failure to properly validate that DNS response records correspond to the original query's zone or domain. When processing DNS replies, the library accepts Resource Records without verifying they belong to the queried zone, creating an opportunity for attackers to inject arbitrary DNS data.

The attack requires network-level access and the ability to intercept or manipulate DNS traffic, but once in position, an attacker can respond to legitimate DNS queries with records from entirely different zones. This undermines the fundamental trust model of DNS resolution and can have cascading effects on applications relying on dnsjava for name resolution.

Root Cause

The root cause is the absence of message normalization and record relevance validation in the DNS response processing logic. Prior to the fix, dnsjava would accept and process records in the authority and additional sections of DNS responses without verifying their relationship to the queried domain. This allowed unknown or irrelevant records to be passed through to the client application or cached for future use.

Attack Vector

The attack exploits the network-based DNS resolution process. An attacker positioned to intercept DNS traffic (such as on a shared network or through BGP hijacking) can craft malicious DNS responses containing records from zones unrelated to the original query. When a vulnerable dnsjava instance processes these responses, it accepts the injected records as legitimate, potentially caching them or presenting them to the application layer.

This attack is particularly dangerous in scenarios where:

• The application uses dnsjava as a DNS resolver
• DNS queries traverse untrusted network segments
• The application relies on DNS records for security-critical decisions

// Security patch introducing dnsjava.harden_unknown_additional configuration option
|1000
|700

+.2+|dnsjava.harden_unknown_additional
+3+|Harden against unknown records in the authority section and additional section.
+If disabled, such records are copied from the upstream and presented to the client together with the answer.
+|Boolean
+|True
+|False

4+h|dnssec options
.2+|dnsjava.dnssec.keycache.max_ttl
3+|Maximum time-to-live (TTL) of entries in the key cache in seconds.

Source: GitHub Commit 2073a0c

Detection Methods for CVE-2024-25638

Indicators of Compromise

• Unexpected DNS records appearing in application logs that don't match queried domains
• DNS cache entries containing records from unrelated zones
• Network traffic showing DNS responses with authority or additional sections containing out-of-zone records
• Applications receiving DNS resolution results that redirect to unexpected IP addresses

Detection Strategies

• Implement deep packet inspection for DNS traffic to identify responses with out-of-zone records in authority or additional sections
• Monitor for applications using dnsjava versions prior to 3.6.0 through software composition analysis (SCA) tools
• Deploy network-based DNS anomaly detection to flag responses where record domains don't match query domains
• Review application dependency manifests for vulnerable dnsjava versions

Monitoring Recommendations

• Enable verbose DNS logging in applications using dnsjava to capture full response details
• Implement DNSSEC validation where possible to detect tampered DNS responses
• Configure network monitoring to alert on DNS traffic anomalies and unexpected response patterns
• Use SentinelOne's application vulnerability scanning to identify systems running vulnerable dnsjava versions

How to Mitigate CVE-2024-25638

Immediate Actions Required

• Upgrade dnsjava to version 3.6.0 or later immediately
• Audit applications for dnsjava dependencies and prioritize updates for internet-facing services
• Enable the dnsjava.harden_unknown_additional configuration option if upgrading is not immediately possible
• Implement network-level DNS security controls such as DNSSEC validation

Patch Information

The vulnerability is fixed in dnsjava version 3.6.0. The fix introduces message normalization that properly validates DNS response records against the original query context. The patch adds the dnsjava.harden_unknown_additional configuration option, which when enabled (default: True in patched versions), hardens the library against unknown records in the authority and additional sections of DNS responses.

For detailed patch information, see the GitHub Security Advisory and the associated commit changes.

Workarounds

• Enable DNSSEC validation at the application or network level to detect tampered responses
• Deploy DNS over HTTPS (DoH) or DNS over TLS (DoT) to prevent on-path attackers from manipulating responses
• Implement application-level validation of DNS records before use in security-critical operations
• Use network segmentation to limit exposure of DNS traffic to potential attackers

# Configuration example for Maven dependency update
# Update pom.xml to use patched dnsjava version
<dependency>
    <groupId>dnsjava</groupId>
    <artifactId>dnsjava</artifactId>
    <version>3.6.0</version>
</dependency>

# For Gradle, update build.gradle:
# implementation 'dnsjava:dnsjava:3.6.0'