Stored Future DDNS Profile ID Allows Unauthorized Use of Another User's Context

Vulnerability Overview Title: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context Description: The vulnerability allows an attacker to use another user's DDNS profile context without authorization by storing a future DDNS profile ID. Specifically, the endpoint accepts and persists non-existent IDs for servers owned by members. If another user subsequently creates a DDNS profile with one of these IDs, the DDNS worker will resolve and dispatch updates, applying the victim user's DDNS profile configuration within the attacker's server context. Affected Versions Affected Versions: >= 2.0.14, < 2.1.0 Fixed Version: 2.1.0 Remediation Recommended Fix: Implement binding time and execution-time validation. - Binding Time Validation: - Reject non-existent DDNS profile IDs. - Reject DDNS profile IDs that do not belong to the caller/server owner. - Reject or limit DDNS profile ID lists that exceed expected bounds. - Execution-Time Validation: - Re-verify that each resolved DDNS profile still belongs to the server owner currently processing the request. - Skip or remove stale, non-existent, or external DDNS profile references before provider dispatch. POC Code ```go // cmd/dashboard/controller/ddns_second_order_test.go func TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testing.T) { t.Parallel() t.Run("TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile", func(t testin

Goal Reached Thanks to every supporter — we hit 100%!

Stored Future DDNS Profile ID Allows Unauthorized Use of Another User's Context

More from this source