DNS Rebinding Protection
Description
Configure DNS resolvers, recursive forwarders, and network firewalls to reject DNS responses that resolve public domain names to private IP addresses (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback: 127.0.0.0/8; link-local: 169.254.0.0/16; IPv6: ::1, fc00::/7, fe80::/10). DNS rebinding attacks exploit the browser same-origin policy by causing an attacker-controlled domain to resolve to a private IP address after the initial page load, giving the attacker JavaScript access to localhost-bound services. Blocking private IP resolution from public domains prevents this attack at the network layer.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Vector (AV) | N → L | An attacker on the public internet cannot reach localhost-bound or private-network services via DNS rebinding. The DNS resolver or firewall blocks responses that would map a public domain to a private address, preventing the browser from connecting to internal services. Exploitation requires the attacker to be on the same local network or have direct access to the host. |
CWE Relationships
Verification
Verify that DNS resolvers are configured to block private IP resolution from public domains, and that firewall rules inspect DNS responses for private address answers.
# Expected: stop-dns-rebind present
# Expected: private-address directives for RFC 1918 ranges
# Expected: No private IP addresses in response (empty output or NXDOMAIN)
Remediation
grep -q '^stop-dns-rebind' /etc/dnsmasq.conf 2>/dev/null || echo 'stop-dns-rebind' >> /etc/dnsmasq.conf
systemctl restart dnsmasq
printf 'server:\n private-address: 10.0.0.0/8\n private-address: 172.16.0.0/12\n private-address: 192.168.0.0/16\n private-address: 127.0.0.0/8\n private-address: 169.254.0.0/16\n private-address: ::1/128\n private-address: fc00::/7\n private-address: fe80::/10\n' > /etc/unbound/conf.d/cme-207-rebind.conf
unbound-checkconf && unbound-control reload