CVE-2023-41329: Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio
Summary
CVE-2023-41329: Impact The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. Affects org.wiremock:wiremock-standalone versions < 3.0.3. Fixed in 3.0.3. How to fix ↓
Also tracked for
The same CVE-2023-41329 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WireMock is an open-source tool used for stubbing and mocking HTTP-based APIs. It allows developers to simulate HTTP responses for testing purposes. WireMock Studio is a proprietary product that provides a graphical interface for creating and managing WireMock configurations. Both WireMock and WireMock Studio are vulnerable to a domain restrictions bypass vulnerability when used in proxy mode. This vulnerability can be exploited through DNS rebinding attacks, allowing an attacker to bypass network restrictions and make requests to prohibited domains.
Vulnerability Detail
The vulnerability arises from a race condition in the logic of WireMock and WireMock Studio. When network restrictions are configured using domain names, a DNS rebinding attack can be used to bypass these restrictions. This attack requires control over a DNS server and has a high execution complexity. The impact of this vulnerability is limited, as it requires specific network configurations and control over DNS services.
How To Fix
Minimum fixed version
3.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For WireMock, there are two possible workarounds:
-
Configure WireMock to use IP addresses instead of domain names in the outbound URLs subject to DNS rebinding.
-
Use external firewall rules to define the list of permitted destinations.
For WireMock Studio, no fix will be provided as the product has been discontinued. The vendor recommends migrating to WireMock Cloud as an alternative.
Conclusion
The domain restrictions bypass vulnerability in WireMock and WireMock Studio can be mitigated by updating to the latest versions and implementing the recommended configurations. It is important to stay updated with security patches and follow best practices to ensure the security of your applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.wiremock:wiremock-standalone →
FAQ
WireMock is an open-source tool used for stubbing and mocking HTTP-based APIs. It allows developers to simulate HTTP responses for testing purposes.
WireMock Studio is a proprietary product that provides a graphical interface for creating and managing WireMock configurations.
A DNS rebinding attack is a technique where an attacker tricks a victim's browser into making requests to a domain that resolves to a different IP address after the initial DNS lookup. This can be used to bypass network restrictions and access prohibited domains.
The impact of this vulnerability is limited, as it requires specific network configurations and control over DNS services. It has a high execution complexity and requires the attacker to have control over a DNS server.
To mitigate this vulnerability, it is recommended to update WireMock to the latest version and configure it to use IP addresses instead of domain names in outbound URLs subject to DNS rebinding. External firewall rules can also be used to define a list of permitted destinations.
