DNS Zone Transfer Check Vulnerability

漏洞信息

漏洞名称： DNS Zone Transfer Check Vulnerability

漏洞类型： 信息泄露

漏洞等级： 中危

漏洞描述： 该漏洞涉及Windows DNS服务器的区域传输配置问题。DNS区域传输是一种将DNS记录从一个DNS服务器复制到另一个DNS服务器的机制，通常用于DNS冗余和负载均衡。如果配置不当，攻击者可以利用未受限制的区域传输获取敏感信息，如内部网络结构、主机名和IP地址等，从而为后续攻击提供便利。

漏洞的技术根源在于DNS服务器的SecureSecondaries注册表值未正确设置为2，该设置用于限制区域传输仅允许指定的服务器进行。如果未设置或设置不当，任何外部实体都可能发起区域传输请求，获取域和区域的详细信息。

此漏洞的影响程度为中等，因为它可能导致信息泄露，但需要攻击者具备一定的网络访问权限才能利用。尽管如此，泄露的信息可能被用于更复杂的攻击，如网络映射和针对性攻击。因此，建议管理员检查并正确配置SecureSecondaries注册表值，以限制区域传输仅对可信服务器开放，或完全禁用区域传输功能，以减轻潜在的安全风险。

产品厂商： Microsoft

产品名称： DNS Server

来源： https://github.com/projectdiscovery/nuclei-templates/blob/b740ee6791c0a6d36cac233d23a096ba91d2f060/code%2Fwindows%2Faudit%2Fkisa%2Fdns-zone-transfer-check.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: dns-zone-transfer-check

info:
  name: DNS Zone Transfer Check
  author: nukunga[SungHyunJeon]
  severity: medium
  description: |
    Ensure DNS zone transfers are restricted by verifying that the SecureSecondaries registry value is set to 2 for all active zones.
    Unrestricted zone transfers can expose sensitive domain information, helping attackers map the network infrastructure.
  impact: |
    If DNS zone transfers are not properly restricted, attackers could access domain and zone details, which may aid in planning and launching further attacks against the network infrastructure.
  remediation: |
    Configure DNS zone transfer restrictions by:
    - Disabling zone transfers entirely, or
    - Restricting transfers to designated servers by setting the SecureSecondaries registry value to 2.
  reference:
    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
  tags: code,windows-audit,kisa,dns,zone-transfer

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      $regPath = "HKLM:\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\DNS Server\Zones"
      $zones = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue
      if (!$zones) {
          "DNS_ZONE_TRANSFER_COMPLIANT"
          exit
      }
      $vulnerable = $false
      foreach ($zone in $zones) {
          $secureVal = (Get-ItemProperty -Path $zone.PSPath -ErrorAction SilentlyContinue).SecureSecondaries
          if ($secureVal -ne 2) {
              $vulnerable = $true
              break
          }
      }
      if ($vulnerable) {
          "DNS_ZONE_TRANSFER_VULNERABLE"
      } else {
          "DNS_ZONE_TRANSFER_COMPLIANT"
      }

    matchers:
      - type: word
        words:
          - "DNS_ZONE_TRANSFER_VULNERABLE"