{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/dns-takeover/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Poweradmin (\u003c 3.9.11)","Poweradmin (\u003c 4.2.5)","Poweradmin (\u003c 4.3.4)"],"_cs_severities":["medium"],"_cs_tags":["idor","dns-takeover","web-application","vulnerability","access-control"],"_cs_type":"advisory","_cs_vendors":["Poweradmin"],"content_html":"\u003cp\u003eA critical Insecure Direct Object Reference (IDOR) vulnerability (GHSA-rm67-g9ch-vxff) has been disclosed in Poweradmin, a web front-end for PowerDNS. Discovered by Saif Salah, this flaw allows any authenticated user possessing ownership of at least one DNS zone to arbitrarily modify, disable, or hijack DNS records in any other zone managed by the server, regardless of their legitimate access permissions. The vulnerability, present across Poweradmin versions prior to 3.9.11, 4.2.5, and 4.3.4, stems from a logical error in the \u003ccode\u003eRecordManager::editRecord()\u003c/code\u003e function. Access control checks are performed against an attacker-controlled zone ID, while the actual record modification is applied to a different, attacker-controlled record ID without verifying their association. This can lead to a full cross-tenant DNS takeover in shared or multi-tenant environments, posing significant risks to DNS integrity and service availability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, authenticated with a low-privilege \u0026quot;Editor\u0026quot; account, owns at least one DNS zone (e.g., \u003ccode\u003eattacker.example\u003c/code\u003e, zone ID 3).\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a target DNS record in a zone they do not own (e.g., \u003ccode\u003ewww.victim.example\u003c/code\u003e with record ID 5, residing in \u003ccode\u003evictim.example\u003c/code\u003e with zone ID 2).\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to their own zone's edit page (e.g., \u003ccode\u003e/zones/3/edit\u003c/code\u003e) and initiates a record save action using an intercepting proxy.\u003c/li\u003e\n\u003cli\u003eWithin the \u003ccode\u003ePOST /zones/3/edit\u003c/code\u003e request body, the attacker manipulates parameters, specifically setting \u003ccode\u003erecord[5][rid]=5\u003c/code\u003e (the victim's record ID) and \u003ccode\u003erecord[5][zid]=3\u003c/code\u003e (the attacker's legitimate zone ID).\u003c/li\u003e\n\u003cli\u003eThe Poweradmin application performs an ownership check using \u003ccode\u003erecord[5][zid]=3\u003c/code\u003e from the request, which passes successfully due to the attacker's legitimate ownership of zone 3.\u003c/li\u003e\n\u003cli\u003eThe application proceeds to modify the record using \u003ccode\u003erecord[5][rid]=5\u003c/code\u003e without verifying that this record (ID 5) actually belongs to zone ID 3, thus overwriting the victim's DNS record (e.g., changing \u003ccode\u003ewww.victim.example\u003c/code\u003e content to \u003ccode\u003e6.6.6.6\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker successfully modifies a DNS record in a zone they are not authorized to access, demonstrating a bypass of intended access controls and potentially leading to DNS takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this IDOR vulnerability allows an authenticated attacker to compromise the integrity and availability of DNS records across the entire Poweradmin installation. Attackers can repoint DNS records (e.g., \u003ccode\u003epwned.attacker.example\u003c/code\u003e) to malicious infrastructure, corrupt existing records, or silently disable critical services by setting the \u003ccode\u003edisabled\u003c/code\u003e flag. In multi-tenant or shared hosting environments, this directly translates to cross-tenant DNS takeover, where one customer's records can be hijacked or disrupted by another using their \u003ccode\u003eattacker.example\u003c/code\u003e domain. This poses a significant threat to an organization's online presence, email delivery, and other services reliant on accurate DNS resolution, potentially leading to widespread service outages or redirection to phishing/malware sites. The attacker's own valid CSRF token and zone serial satisfy all form-level checks, making the malicious request appear legitimate to the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Poweradmin installations immediately to versions 3.9.11, 4.2.5, or 4.3.4 or later to address the vulnerability described in the GHSA-rm67-g9ch-vxff advisory.\u003c/li\u003e\n\u003cli\u003eImplement server-side validation, as suggested in the GHSA-rm67-g9ch-vxff advisory, to ensure the record ID being modified truly belongs to the zone ID used for access checks.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous \u003ccode\u003ePOST /zones/*/edit\u003c/code\u003e requests, paying attention to the context around the \u003ccode\u003erid\u003c/code\u003e and \u003ccode\u003ezid\u003c/code\u003e parameters in the request body for evidence of the IDOR identified in the attack chain.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:57:43Z","date_published":"2026-07-24T21:57:43Z","id":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-idor/","summary":"A low-privilege authenticated user in Poweradmin (a web front-end for PowerDNS) can exploit an Insecure Direct Object Reference (IDOR) vulnerability, allowing them to modify any DNS record on the server, even those they do not own, by manipulating POST request parameters to bypass access control checks and achieve DNS record repointing, disabling, or hijacking, leading to data integrity and availability issues, and potentially cross-tenant DNS takeover.","title":"Poweradmin: Broken Access Control (IDOR) Allows DNS Record Modification","url":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Dns-Takeover","version":"https://jsonfeed.org/version/1.1"}