Description

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-20T19:17:03.637Z",
  "pubdate": "2026-08-20T19:17:03.637Z",
  "executiveSummary": "An unauthenticated remote vulnerability exists in BunkerWeb prior to version 1.6.13, specifically within the blacklist, greylist, and antibot security modules. The flaw stems from insecure reverse DNS (rDNS) validation logic where the application trusts PTR suffix matches without confirming via forward resolution that the hostname actually maps back to the client IP address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted domain suffix to bypass security controls. The business impact includes unauthorized security control evasion, allowing malicious actors to completely bypass rDNS-based blacklisting, improperly obtain greylist treatment, or entirely skip mandatory antibot challenges. The risk implications are severe, as perimeter defenses designed to mitigate automated threats and malicious traffic can be systematically deceived. Exploitation requires the attacker to control a rogue PTR record and route traffic while presenting the spoofed rDNS suffix, requiring no prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the core Lua modules of BunkerWeb, specifically within src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua. The root cause of the flaw is the application's reliance on unsecured PTR suffix matching against configuration directives such as IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS. Instead of utilizing proper IP confirmation functions like get_ips to verify that the claimed hostname resolves back to the connecting client IP address, the code blindly checks string suffix matching on the raw rDNS output. The attack flow proceeds as follows: First, an unauthenticated remote attacker initiates a connection to a BunkerWeb-protected web application from an IP address under their control. Second, when the blacklist, greylist, or antibot modules attempt to evaluate the client's identity or trustworthiness, they perform a reverse DNS lookup on the attacker's connecting IP. Third, because the attacker controls the authoritative nameserver for their IP space, they configure a custom PTR record terminating in a trusted suffix defined within BunkerWeb's configuration (e.g., a corporate domain or internal service suffix). Fourth, the vulnerable Lua scripts evaluate the PTR record, observe a successful suffix match, and fail to perform a forward resolution sanity check. Finally, the application treats the untrusted connection as trusted, allowing the attacker to bypass the blacklist, receive greylisting exemptions, or entirely skip the antibot challenge mechanism. The vulnerable components affect BunkerWeb versions prior to 1.6.13. The vulnerability is network-exposed, can be exploited over the internet by any unauthenticated remote attacker, and requires no special privileges beyond the ability to configure standard PTR records for the source IP address used during the attack."
}