CyberRota Analysis
AI-GeneratedBunkerWeb versions prior to 1.6.13 are vulnerable due to improper validation of PTR suffix matches in the blacklist, greylist, and antibot modules, allowing unauthenticated remote attackers to spoof trusted suffixes. This vulnerability can lead to bypassing rDNS-based blacklisting, resulting in unauthorized access or evasion of security measures. Organizations using BunkerWeb should prioritize upgrading to version 1.6.13 to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.