Broken ECS Source Validation Bypass in dnsmasq

This repository is a dnsmasq vulnerability verification toolkit centered on CVE-2026-2291, CVE-2026-5172, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, and CVE-2026-4893. It is not tied to a common exploit framework. The repository contains four functional scripts plus documentation: (1) dnsmasq_cve_verify.py is the primary end-to-end black-box verifier that runs from a testing laptop, starts a malicious DNS service, sends trigger traffic to the DUT, and uses SSH to inspect dnsmasq state and logs before issuing PASS/FAIL verdicts; (2) malicious_dns_server.py is a standalone UDP DNS server that returns crafted malformed responses for manual reproduction of selected parser bugs, notably CVE-2026-5172 and DNSSEC-related issues; (3) test_dnsmasq_cve_remote.py is a lightweight remote detection script that queries version.bind over UDP/53 and infers vulnerability status from the reported dnsmasq version; and (4) test_dnsmasq_cve_on_device.sh is a shell-based local checker that runs on the target device and uses version/strings heuristics to assess patch status and feature applicability. The main exploit capability is network-based triggering of dnsmasq parsing flaws through malicious DNS responses. The code crafts malformed CNAME/rdlen combinations, DNSSEC/NSEC/RRSIG-related records, and ECS-related inputs to induce crashes, hangs, or logic bypasses in vulnerable dnsmasq builds. The README also describes a DHCPv6 CLID overflow test for CVE-2026-4892, which is a local/adjacent vector requiring DHCPv6 support and dhcp-script configuration. The repository therefore mixes active exploit-style verification with auxiliary detection scripts. Because payloads are hardcoded and purpose-built for QA verification rather than generalized post-exploitation, the maturity is best classified as OPERATIONAL rather than weaponized. Fingerprintable observables include the default DUT IP 192.168.1.1, example attacker IP 10.0.0.211, SSH on TCP/22, DNS on UDP/53, trigger domains such as crash-5172.evil.test and crash-2291.evil.test, the version.bind CHAOS TXT query, and DUT file paths like /etc/dnsmasq.conf, /tmp/resolv.conf.auto, /sbin/dnsmasq, /usr/sbin/dnsmasq, and /var/log/messages*. Overall, the repository’s purpose is QA/security validation of dnsmasq patch status and exploitability in live devices, especially routers or embedded Linux systems using dnsmasq as a DNS forwarder.

This repository is a small, focused proof-of-concept exploit for a dnsmasq ECS validation issue. It contains three files: a Python exploit script (exp.py), a sample dnsmasq configuration (dnsmasq.conf), and a short README with setup steps. The exploit is not part of a larger framework. The main logic is in exp.py. It implements a fake upstream UDP DNS server that binds to 127.0.0.1:5354, which matches the upstream server configured in dnsmasq.conf. The script parses incoming DNS queries, only responds if the source IP is 127.0.0.1 (dnsmasq) and the queried name is trigger.evil.com., then sends back a crafted DNS response containing: (1) an A record resolving the trigger name to 1.2.3.4, and (2) an EDNS0 ECS option (code 8) with a deliberately mismatched subnet value of 127.18.0.0/24. The intended capability is to demonstrate that a vulnerable dnsmasq instance improperly accepts this mismatched ECS response from its upstream server. The script also includes a built-in self-test thread. After startup, it sends a DNS query for trigger.evil.com to the configured dnsmasq listener at xxx.xxx.xxx.x:5353, waits for dnsmasq's reply, parses the answer section, and reports the target as vulnerable if dnsmasq returns the fake IP 1.2.3.4. This makes the repository both an exploit PoC and a validation harness. Repository structure and purpose: - exp.py: primary exploit and verification logic; contains DNS packet parsing, DNS response crafting, ECS option construction, UDP listener, and self-test. - dnsmasq.conf: minimal sample configuration showing dnsmasq listening on port 5353 and forwarding to 127.0.0.1:5354. - readme.txt: setup instructions, including enabling add-subnet and running the Python script. Overall, this is an operational network-based PoC for testing whether dnsmasq accepts attacker-controlled upstream DNS replies with mismatched ECS metadata. It does not deliver code execution; instead, it demonstrates DNS response spoofing/poisoning-style behavior by causing dnsmasq to return an attacker-chosen IP for a controlled domain under specific configuration conditions.