Executive brief
BunkerWeb is an open-source web application firewall that uses reverse DNS (rDNS) lookups to make trust decisions about incoming traffic, such as blocking or rate-limiting requests. An attacker who controls a PTR (reverse DNS) record can spoof a trusted domain suffix to bypass the firewall's blacklist, gain preferential treatment, or skip security challenges, effectively defeating these protective mechanisms.
Technical details
The vulnerability is an insufficient validation flaw in the blacklist, greylist, and antibot modules (src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua). These modules trust rDNS PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without performing forward-confirm reverse DNS (FCrDNS) validation to verify that the hostname actually resolves back to the client's IP address. An unauthenticated remote attacker who controls a PTR record can set a malicious PTR to match a trusted suffix (e.g., ".googlebot.com") and bypass security controls. The vulnerability requires no authentication or special network access beyond control of a PTR record. The fix, deployed in version 1.6.13, implements FCrDNS validation to confirm hostname-to-IP mappings before honoring rDNS-based trust decisions.
Affected products
- Bunkerity BunkerWeb prior to 1.6.13
Timeline
- 2026-08-20: disclosed
- 2026-07-08: patched: Fix committed; released in version 1.6.13