Penetration Test Report (X41 D-Sec): X41 OSTIF Hickory DNS 2025 Audit Report Public

CodeReviewonHickoryDNS
fortheHickoryDNSTeam
FinalReportandManagementSummary
2024-10-25
PUBLIC
X41 D-Sec GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
CodeReviewonHickoryDNS HickoryDNSTeam
Revision Date Change Author(s)
1 2024-10-18 FinalDraftReport E. Sesterhenn JM R. Femmer M.
Vervier
2 2024-10-25 FinalReportandManagement E. Sesterhenn JM R. Femmer M.
Summary Vervier
X41D-SecGmbH PUBLIC Page1of31
CodeReviewonHickoryDNS HickoryDNSTeam
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 RatingMethodologyforSecurityVulnerabilities 11
4 Results 13
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
5 AboutX41D-SecGmbH 30
X41D-SecGmbH PUBLIC Page2of31
CodeReviewonHickoryDNS HickoryDNSTeam
Dashboard
Target
Customer HickoryDNSTeam
Name HickoryDNS
Type NetworkDaemon
Version e0b24aa5c12598f618c926198b255f9845ae475f
Engagement
Type GrayBoxPenetrationTest
Consultants 4:EricSesterhenn,JM,MarkusVervier,andRobertFemmer
EngagementEffort 30person-days,2024-09-16to2024-10-07
Totalissuesfound 4
Critical - 0
High - 0
Medium - 2
Low - 2
CWE-400(4)
None - 7
0 1 2 3 4 5 6 7
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of31
CodeReviewonHickoryDNS HickoryDNSTeam
1 Executive Summary
InSeptember2024,X41D-SecGmbHperformedacodeauditagainsttheHickoryDNSlibrary
toidentifyvulnerabilitiesandweaknessesintherecursor,clientandserverimplementations.
AtotaloffourvulnerabilitieswerediscoveredduringthetestbyX41.Nonewereratedashavinga
criticalseverity,noneashigh,twoasmedium,andtwoaslow.Additionally,sevenissueswithout
adirectsecurityimpactwereidentified.
Low - 2 Medium - 2
Figure1.1:IssuesandSeverity
HickoryDNSisacollectionofDNSlibrariesimplementingaDNSauthoritativeserver,clientand
recursiveresolver. ThesoftwaremaybeusedaspartoftheDNSdistributeddatabase. Vulner-
abilities in the application would allow an attacker to disrupt a core service of the Internet by,
e.g. by flooding important servers with packets leveraging an amplification attack or hijacking
connectionsofuserstoimportantInternetservicesbypoisoningtheDNScache.
Inasourcecodeaudit,allinformationaboutthesystemismadeavailable.Thetestwasperformed
X41D-SecGmbH PUBLIC Page4of31
CodeReviewonHickoryDNS HickoryDNSTeam
byfourexperiencedsecurityexpertsbetween2024-09-16and2024-10-07.
Themostsevereissuesidentifiedinthisauditallowanattackertoconsumeallprocessing,mem-
oryorconnectionresourcesonthemachinerunningaHickoryDNSrecursororserver.Thismay
disruptInternetserviceforusersaswellasenableblindDNScachepoisoningattacksperformed
againstdownstreamservers,whichrelyonanswersfromaHickoryDNSserver.
The code base is new and has not seen significant use in a production setting and frequent
changesaretobeexpectedinthefuture. Itisrecommendedtorepeatathoroughsourcecode
reviewinduetime.DuetotheuseofRust,memorysafetyissuesareavoided.However,thecode
basedoesnotlimittheuseofsystemresourcessufficientlyandDoSconditionscanbetriggered
withloweffort.Theseissuesposeonlyaminorthreattotheoverallsecurityofthesystem.
X41D-SecGmbH PUBLIC Page5of31
CodeReviewonHickoryDNS HickoryDNSTeam
2 Introduction
X41reviewedtheHickoryDNS1 sourcecodewhichcontainsaDNSclient,serverandrecursor.
TheyareconsideredsensitivebecauseDNSconstitutesafundamentalpartoftheInternetinfras-
tructure. A successful attack may enable an attacker to hijack connections of users requesting
websitesandtransferringsensitivedata. Inlesssophisticatedscenarios,faultyDNSserverscan
beusedtogeneratelargeamountsofInternettraffic,whichmaycauseDoS2conditionsforother
Internetservices.
Attackerscouldtrytoattacktheserverandresolverbysendingmaliciousqueriesorresponses.
Additionally,attacksagainstthecachingbehaviororDNSspecificprotocolattacksmaybepossi-
ble.
2.1 Methodology
ThereviewwasbasedonasourcecodereviewoftheRustcodebase.
A manual approach for penetration tests and for code reviews is used by X41. This process is
supportedbytoolssuchasstaticcodeanalyzersandindustrystandardwebapplicationsecurity
tools3.
X41adherestoestablishedstandardsforsourcecodereviewingandpenetrationtesting. These
areinparticulartheCERTSecureCoding4 standardsandtheStudy-APenetrationTestingModel5
oftheGermanFederalOfficeforInformationSecurity.
The workflow of source code reviews is shown in figure 2.1. In an initial, informal workshop
1DomainNameSystem
2DenialofService
3https://portswigger.net/burp
4https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
5https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH PUBLIC Page6of31
CodeReviewonHickoryDNS HickoryDNSTeam
regardingthedesignandarchitectureoftheapplicationabasicthreatmodeliscreated. Thisis
used to explore the source code for interesting attack surface and code paths. These are then
auditedmanuallyandwiththehelpoftoolssuchasstaticanalyzersandfuzzers. Theidentified
issuesaredocumentedandcanbeusedinaGAPanalysistohighlightchangestopreviousaudits.
Ini�al Design Threat Code
Workshop Modelling Review
Fixing and GAP / Performance
Documenta�on
Mi�ga�on Analysis
Figure2.1:CodeReviewMethodology
X41D-SecGmbH PUBLIC Page7of31
CodeReviewonHickoryDNS HickoryDNSTeam
2.2 Findings Overview
DESCRIPTION SEVERITY ID REF
StackOverflowinRecursor LOW HCKRYDNS-CR-24-01 4.1.1
DoSviaOpenConnections MEDIUM HCKRYDNS-CR-24-02 4.1.2
ResolverVulnerabletoKeyTrapAttack MEDIUM HCKRYDNS-CR-24-03 4.1.3
OutofMemoryDenialofServiceinRecursor LOW HCKRYDNS-CR-24-04 4.1.4
HickoryAcceptsInvalidDomainLabels NONE HCKRYDNS-CR-24-100 4.2.1
TimeoutinRecursorDuetoMisconfiguredUpstream NONE HCKRYDNS-CR-24-101 4.2.2
NoWarningforUnprotectedKeys NONE HCKRYDNS-CR-24-102 4.2.3
HickoryDaemonRunningasRoot NONE HCKRYDNS-CR-24-103 4.2.4
NoRate-Limits NONE HCKRYDNS-CR-24-104 4.2.5
FailingUnitTests NONE HCKRYDNS-CR-24-105 4.2.6
No0x20-EncodingEmployedinRecursor NONE HCKRYDNS-CR-24-106 4.2.7
Table2.1:Security-RelevantFindings
2.3 Scope
Theauditwasbasedontheopensourcecodebase6 availableonGitHubandbasedoncommit
e0b24aa5c12598f618c926198b255f9845ae475f7.
Therepositorycontainedaround70kLoCofRustcode.
ADiscordchatgroupwasavailabletodiscussquestionsbetweenthedevelopersandthetesters.
SeveresecurityissuesweretobereportedviaGitHubSecurityduringthetest.
2.4 Coverage
Asecuritysourcecodeauditattemptstofindthemostimportantorsometimesasmanyofthe
existingproblemsaspossible,thoughitispracticallyneverpossibletoruleoutthepossibilityof
additionalweaknessesbeingfoundinthefuture.
Thesourcecodewasinspectedwithsemgrep8.TimeouthandlingwasinspectedforpossibleDoS
situations. The daemon was tested whether it is affected by classic DNS attacks such as DNS
amplification.MarkersinthecodesuchasTODO orFIXME wereinspectedonwhethertheyhave
animpactonthesecurityoftheservice.Asimilarauditwasperformedforplacesthatpanicand
6https://github.com/hickory-dns/hickory-dns
7https://github.com/hickory-dns/hickory-dns/tree/e0b24aa5c12598f618c926198b255f9845ae475f
8https://semgrep.dev/
X41D-SecGmbH PUBLIC Page8of31
CodeReviewonHickoryDNS HickoryDNSTeam
whethertheycouldbeabusedforDoS. SomefuzztestingwasperformedusingthenmapDNS
fuzzer9 anddns-fuzzer10.
Theimplementationandtheobservedbehavioroftheapplicationwasheldagainstthevarious
DNSRFCs11.
Thesourcecodewasinspectedforcachepoisoningvulnerabilities12 andvulnerabilitiesknown
asKe