ShipIt Clean — 664823b2b126

Total Findings

Critical

High

Medium

Low

main @ d90e4bd

AIAI Threat Analysis

REAL THREATS

Supply Chain & External Resource Attacks

• CRITICAL (0): update-rpz.sh downloads from user-controlled URLs without authentication, enabling SSRF/data exfiltration.

• HIGH (4, 6, 7): Unvalidated URL downloads in RPZ scripts with no certificate verification, allowing MITM attacks and open redirects.

• MEDIUM (12, 28, 30): User-controlled URLs for RPZ blocklists and root hints without validation.

• MEDIUM (29): Unbounded root hints download could lead to disk exhaustion.

Input Validation & Injection Vulnerabilities

• HIGH (2): Zone names and hostnames logged without PII filtering, exposing sensitive DNS data.

• HIGH (5): Unvalidated URL in log output could leak sensitive data through log injection.

• MEDIUM (16, 22): Error messages leak jq expression details and URL/file path information.

• MEDIUM (18, 20, 21): Unvalidated file input processing, URL parsing without scheme validation, and unsanitized hostnames written to DNS zones.

• MEDIUM (19): No input validation on jq expressions in genrpz.py.

Denial of Service

• HIGH (3): Unbounded file download in RPZ update script enables disk exhaustion.

• MEDIUM (17, 23, 32): No input file size validation, missing rate limiting on RPZ update cron jobs, and cron job configuration lacks rate limiting constraints.

Security Misconfiguration

• HIGH (10): SELinux semanage installation fails silently, potentially leaving ports unconfigured.

• MEDIUM (13): DNSSEC validation disabled by default weakens DNS security.

• MEDIUM (25, 26): Test profile uses weak DH parameters (1024-bit) and unusual SELinux port configuration.

• MEDIUM (38): Overly restrictive TLS cipher configuration could break compatibility.

Missing Security Controls

• HIGH (11): No correlation IDs for RPZ update operations hinders traceability.

• MEDIUM (14, 15, 24, 27, 37): Missing request logging for DoH/DoT, unstructured logs, lack of audit trails for RPZ updates, root hints updates, and TLS certificate operations.

• MEDIUM (33, 34): Cron job execution without input validation and insufficient monitoring of RPZ update failures.

• MEDIUM (35, 36): RPZ update cron jobs execute as root with failures silently ignored.

ATTACK CHAINS

1. SSRF → Data Exfiltration → Persistence: An attacker could chain findings 0, 4, 6, and 7 to:

- Use the unauthenticated URL download in update-rpz.sh to perform SSRF attacks against internal services - Intercept downloads via MITM due to missing certificate verification - Inject malicious content into logs or DNS zones - Establish persistence through cron jobs that execute as root

2. DoS → Log Injection → Information Disclosure: Findings 3, 5, and 2 could be combined to:

- Exhaust disk space with large downloads - Inject malicious content into error logs - Extract sensitive DNS zone information from logs

VERDICT

Immediate fixes required:

1. CRITICAL: Fix the SSRF vulnerability in update-rpz.sh (0) by implementing URL validation, authentication checks, and download limits.

2. HIGH: Address the supply chain issues (4, 6, 7) by adding certificate verification, URL validation, and secure download mechanisms.

3. HIGH: Implement proper input validation and logging sanitization (2, 5, 16, 18-22) to prevent injection attacks and information disclosure.

4. HIGH: Fix the silent failure in SELinux configuration (10) and add correlation IDs for RPZ operations (11).

Secondary priorities:

• Implement rate limiting and file size validation to prevent DoS (3, 17, 23, 29, 32)

• Enable DNSSEC validation by default (13)

• Add comprehensive audit logging and monitoring (14, 15, 24, 27, 33-37)

• Fix weak cryptographic configurations (25, 38)

The RPZ update system presents the greatest attack surface, with multiple chained vulnerabilities that could lead to complete system compromise. The DNS server's critical role in network infrastructure makes these issues particularly dangerous.

36 raw scanner findings — 1 critical · 6 high · 26 medium · 3 low

▶ Raw Scanner Output — 44 pre-cleanup findings

⚠ Pre-Cleanup Report
This is the raw, unprocessed output from all scanner agents before AI analysis. Do not use this to fix issues individually. Multiple agents attack from different angles and frequently report the same underlying vulnerability, resulting in significant duplication. Architectural issues also appear as many separate line-level findings when they require a single structural fix.

Use the Copy Fix Workflow button above to get the AI-cleaned workflow — it deduplicates findings, removes false positives, and provides actionable steps. This raw output is provided for transparency and audit purposes only.

HIGHZone names and hostnames logged without PII filtering

files/genrpz.py:187

[AGENTS: Trace]sensitive-data-in-logs

The script generates RPZ zone files that may contain sensitive domain information. The logging statements could expose internal domain names, blocked sites, or user-specific data through log aggregation.

Suggested Fix

Implement log filtering to mask sensitive domain patterns. Add option to disable verbose logging in production environments.

HIGHUnbounded file download - disk exhaustion vulnerability

files/update-rpz.sh:14

[AGENTS: Siege]dos

curl command downloads files without any size limit or rate limiting. An attacker could provide a URL that returns a multi-gigabyte file, consuming disk space and potentially causing denial of service.

Suggested Fix

Add --max-filesize option to curl: curl --max-filesize 100M -fLso "$newfile" "$url"

HIGHUnvalidated URL download in RPZ update script

files/update-rpz.sh:14

[AGENTS: Gateway]supply_chain

The script downloads zone files from arbitrary URLs via curl without any URL validation, whitelist, or integrity verification. An attacker who compromises the URL source could inject malicious RPZ data, redirect queries to attacker-controlled servers, or perform DNS poisoning.

Suggested Fix

Implement URL whitelist validation before download. Add checksum verification (SHA256) of downloaded files. Consider using signed zone files with GPG verification.

HIGHUnvalidated URL in log output could expose sensitive data

files/update-rpz.sh:14

[AGENTS: Trace]log-injection

The script logs the URL variable directly without sanitization. If the URL contains sensitive data or malicious content, it could be logged and potentially exfiltrated through log aggregation systems.

Suggested Fix

Add URL validation and sanitization before logging. Use a whitelist of allowed domains or validate URL format before including in logs.

HIGHNo certificate verification for RPZ downloads

files/update-rpz.sh:15

[AGENTS: Cipher]cryptography

**Perspective 1:** The update-rpz.sh script downloads RPZ files using curl without TLS certificate verification (-fL flag). This allows man-in-the-middle attacks to inject malicious RPZ data. **Perspective 2:** Downloaded RPZ files are not verified against checksums or signatures. Compromised RPZ sources could inject malicious blocking rules.

Suggested Fix

Implement SHA256 checksum verification or PGP signature verification for downloaded RPZ files.

HIGHUnvalidated user-controlled URL in curl download

files/update-rpz.sh:16

[AGENTS: Blacklist]open_redirect

The script accepts a user-controlled URL via command-line argument and downloads it directly with curl without any URL validation, scheme checking, or domain allowlisting. An attacker could supply a malicious URL to download and process arbitrary content into the RPZ zone file.

Suggested Fix

Validate the URL scheme (https only), check domain against allowlist, and verify content type before processing

HIGHSELinux semanage installation fails silently

tasks/install.yml:48

[AGENTS: Fuse]fail_open

Package installation for semanage uses 'failed_when: false' without proper error handling. If SELinux policy tools fail to install, the role continues without SELinux protections, leaving the BIND server exposed to privilege escalation attacks.

Suggested Fix

Remove 'failed_when: false' and add explicit error handling or conditional logic based on SELinux status

HIGHNo correlation IDs for RPZ update operations

tasks/rpz-scripts.yml:85

[AGENTS: Trace]missing-correlation-ids

RPZ update operations lack correlation IDs, making it impossible to trace the full lifecycle of a zone update across multiple systems (download, processing, DNS reload).

Suggested Fix

Generate and include unique correlation IDs in all RPZ update operations for end-to-end traceability.

MEDIUMUser-controlled URL for RPZ blocklist downloads

defaults/main.yml:65

[AGENTS: Blacklist]content_security

The bind_response_policy_zones variable accepts URLs for downloading RPZ blocklists without validation. Attackers could supply malicious URLs to distribute poisoned DNS responses.

Suggested Fix

Implement URL validation (https only, domain allowlist) for RPZ download URLs

MEDIUMDNSSEC Validation Disabled by Default

defaults/main.yml:67

[AGENTS: Infiltrator]attack_surface

bind_dnssec_validation defaults to false, meaning DNSSEC validation is not enabled. This leaves the DNS server vulnerable to DNS spoofing and cache poisoning attacks.

Suggested Fix

Set bind_dnssec_validation to true by default or provide clear documentation and guidance for enabling DNSSEC validation.

MEDIUMDoH/DoT connections not logged

defaults/main.yml:118

[AGENTS: Trace]missing-request-logging

DNS-over-HTTP and DNS-over-TLS connections are not logged. This creates a blind spot for security monitoring of encrypted DNS traffic which is critical for detecting DNS-based attacks.

Suggested Fix

Add logging configuration for DoH/DoT connection attempts including source IP, timestamp, and query type.

MEDIUMRPZ generation lacks structured logging

files/genrpz.py:15

[AGENTS: Trace]unstructured-logs

The script uses print statements for error messages which are unstructured and difficult to parse by log analysis tools. This reduces effectiveness of SIEM integration and automated alerting.

Suggested Fix

Use structured logging format (JSON) with consistent field names for timestamps, severity, and error codes.

MEDIUMjq command errors leak expression details

files/genrpz.py:103

[AGENTS: Fuse]error_disclosure

When jq command fails, the error message includes the jq expression used, which could reveal internal filtering logic and data structures to attackers.

Suggested Fix

Remove jq_expression from error output: print(f'Error running jq: {result.stderr}', file=sys.stderr) should not include the expression

MEDIUMNo input file size validation in RPZ generator

files/genrpz.py:112

[AGENTS: Siege]dos

genrpz.py processes input files without size limits. Large input files could cause memory exhaustion during processing.

Suggested Fix

Add file size validation at the start of main() function with configurable maximum size

MEDIUMUnvalidated File Input Processing

files/genrpz.py:135

[AGENTS: Infiltrator]attack_surface

The genrpz.py script processes input files (CSV, JSON, URLs) without strict validation. Malicious input could potentially cause unexpected behavior or information disclosure through error messages or processing of malformed data.

Suggested Fix

Add input validation, sanitization, and proper error handling. Implement file size limits and content validation before processing.

MEDIUMNo input validation on jq expression

files/genrpz.py:145

[AGENTS: Cipher]cryptography

The jq_expression parameter is used directly in subprocess.run without validation. Malicious input could lead to command injection or unexpected behavior.

Suggested Fix

Validate and sanitize jq_expression input, or use a whitelist of allowed characters.

MEDIUMURL parsing without scheme validation

files/genrpz.py:162

[AGENTS: Blacklist]input_validation

The parse_url function accepts any URL string and extracts netloc without validating the URL scheme. Malicious URLs with unusual schemes or encoded characters could bypass intended security controls.

Suggested Fix

Validate URL scheme is http or https before parsing, reject malformed URLs

MEDIUMUser-controlled hostnames written to DNS zone without sanitization

files/genrpz.py:195

[AGENTS: Blacklist]output_encoding

The generate_rpz function writes hostnames directly to the output file without validating or sanitizing them. Malicious hostnames could contain special characters that might cause issues in DNS zone files or be used for DNS rebinding attacks.

Suggested Fix

Validate hostname format using regex (^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$) and reject invalid entries

MEDIUMError messages leak URL and file path information

files/update-rpz.sh:16

[AGENTS: Fuse]error_disclosure

Error messages in the shell script include the full URL being fetched and file paths, which could leak internal infrastructure information to attackers who can trigger errors.

Suggested Fix

Sanitize error messages to remove sensitive paths and URLs, or log them separately with restricted access

MEDIUMMissing rate limiting on RPZ update cron jobs

files/update-rpz.sh:17

[AGENTS: Siege]dos

Cron jobs for RPZ updates can be configured to run frequently without rate limiting. An attacker could configure extremely frequent updates to exhaust system resources.

Suggested Fix

Add minimum interval validation in defaults/main.yml and document recommended cron intervals

MEDIUMRPZ update operations lack audit logging

files/update-rpz.sh:22

[AGENTS: Trace]missing-audit-trail

The script performs critical DNS security operations (RPZ zone updates) without any audit logging. Failed updates, successful downloads, and file modifications are not tracked for security monitoring.

Suggested Fix

Add structured logging with timestamps, user context, and operation details. Log all RPZ update attempts including failures.

MEDIUMTest profile uses weak DH parameters

molecule/default/molecule.yml:136

[AGENTS: Gateway]weak_crypto

The tls_alpine test profile sets bind_tls_dhparam_size to 1024 bits, which is below current security recommendations (minimum 2048 bits). While this is test configuration, it could indicate weak crypto defaults in production.

Suggested Fix

Update test profile to use 2048-bit minimum DH parameters. Ensure production defaults enforce 2048+ bits.

MEDIUMUnusual SELinux port configuration for DNS

tasks/install.yml:57

[AGENTS: Gateway]misconfiguration

SELinux configuration opens ports 80 and 443 for DNS service. Port 80 is HTTP, not DNS-over-HTTP (which uses 443). This could allow unintended traffic or indicate misconfiguration of DoH/DoT endpoints.

Suggested Fix

Verify DoH configuration uses port 443 only. Remove port 80 unless HTTP-based DNS (not DoH) is explicitly configured and intended.

MEDIUMNamed root hints updates lack audit logging

tasks/main.yml:22

[AGENTS: Trace]missing-audit-trail

The named.root file download operation is not logged. This is a critical DNS infrastructure change that should be audited for security compliance and incident investigation.

Suggested Fix

Add audit logging for all named.root file operations including source URL, timestamp, and checksum verification.

MEDIUMUnvalidated external URL for root hints download

tasks/main.yml:33

[AGENTS: Blacklist]content_security

The role downloads named.root from bind_named_root_url without validation. While the default is a trusted URL, users can override this variable to point to malicious sources, potentially downloading poisoned DNS root hints.

Suggested Fix

Add URL validation and consider using a whitelist of trusted root hints sources

MEDIUMUnbounded root hints download - disk exhaustion

tasks/main.yml:33

[AGENTS: Siege]dos

get_url task downloads named.root file without size limits. While the file is typically small, no validation prevents disk exhaustion if URL is manipulated.

Suggested Fix

Add backup size validation or use --max-size option if supported

MEDIUMHardcoded root hints URL without validation

tasks/main.yml:36

[AGENTS: Gateway]supply_chain

The named.root file URL is hardcoded without any validation mechanism. If the source is compromised, all DNS servers using this role could receive poisoned root hints, enabling DNS poisoning attacks across the infrastructure.

Suggested Fix

Implement URL validation with checksum verification. Consider using multiple redundant sources or a signed root hints distribution.

MEDIUMNamed root hints update fails silently

tasks/main.yml:38

[AGENTS: Fuse]fail_open

The get_url task for named.root uses 'failed_when: false', allowing the role to continue even if the root hints download fails. This could leave BIND with stale root hints, affecting DNSSEC validation.

Suggested Fix

Remove 'failed_when: false' or add conditional logic to only skip if explicitly configured

MEDIUMCron job configuration lacks rate limiting constraints

tasks/rpz-scripts.yml:58

[AGENTS: Siege]dos

RPZ update cron jobs can be configured with arbitrary frequencies. No validation prevents extremely frequent execution that could exhaust CPU/disk resources.

Suggested Fix

Add validation for cron frequency in defaults/main.yml with minimum interval checks

MEDIUMCron Job Execution Without Input Validation

tasks/rpz-scripts.yml:67

[AGENTS: Infiltrator]attack_surface

The RPZ update cron jobs execute update-rpz.sh with URLs from user configuration. If an attacker can inject malicious URLs into bind_response_policy_zones, the cron job will execute arbitrary downloads and potentially execute malicious code.

Suggested Fix

Validate URLs against allowlist, implement rate limiting, add authentication tokens, and monitor cron job execution for anomalies.

MEDIUMRPZ update failures not monitored or alerted

tasks/rpz-scripts.yml:78

[AGENTS: Trace]insufficient-monitoring

The role checks if more than half of RPZ update commands failed but does not generate alerts or notifications. This could allow persistent DNS poisoning attacks to go undetected.

Suggested Fix

Add alerting mechanism for RPZ update failures. Integrate with monitoring systems like Prometheus or send notifications to security teams.

MEDIUMRPZ update cron jobs execute as root

tasks/rpz-scripts.yml:82

[AGENTS: Gateway]privilege_escalation

RPZ update cron jobs run with root privileges. If the update-rpz.sh script is compromised or contains malicious code, it could lead to full system compromise. The script has write access to zone files that BIND uses for DNS responses.

Suggested Fix

Run cron jobs as a dedicated low-privilege user with minimal permissions. Use setuid wrapper or drop privileges after initial setup.

MEDIUMRPZ update failures silently ignored

tasks/rpz-scripts.yml:98

[AGENTS: Fuse]fail_open

The task uses 'failed_when: false' which allows the role to continue even when RPZ update commands fail. This creates a fail-open pattern where DNS security updates may not be applied, leaving the system vulnerable to DNS poisoning attacks.

Suggested Fix

Change 'failed_when: false' to 'failed_when: true' or add proper validation that at least some updates succeeded before continuing

MEDIUMTLS certificate operations lack audit trail

tasks/tls.yml:17

[AGENTS: Trace]missing-audit-trail

Private key generation, CSR creation, and certificate operations are not logged. These are sensitive cryptographic operations that should be audited for security compliance.

Suggested Fix

Add audit logging for all TLS operations including key generation, certificate creation, and file permissions.

MEDIUMOverly Restrictive TLS Cipher Configuration

vars/main.yml:3

[AGENTS: Infiltrator]attack_surface

The bind_tls_ciphers string excludes SHA256 and SHA384 ciphers ('!SHA256:!SHA384'), which are modern and secure ciphers. This weakens TLS security posture unnecessarily and may cause compatibility issues.

Suggested Fix

Remove !SHA256 and !SHA384 from the cipher string to allow modern secure ciphers while maintaining security.

LOWNo log rotation configuration defined

defaults/main.yml:109

[AGENTS: Trace]log-rotation

Query logging and RPZ logging are configurable but there is no logrotate configuration included. This could lead to disk space exhaustion and loss of historical security data.

Suggested Fix

Add logrotate configuration template or include logrotate config in the role files.

LOWDH param size default may be insufficient for DoT

defaults/main.yml:113

[AGENTS: Siege]dos

bind_tls_dhparam_size defaults to 2048 bits which is acceptable but could be increased. Not a DoS vulnerability but could affect TLS performance under load.

Suggested Fix

Consider increasing to 4096 for better security margin

LOWDNS zone file lacks proper quoting for special characters

files/genrpz.py:104

[AGENTS: Blacklist]output_encoding

The RPZ zone file generation writes hostnames directly without escaping special characters that might be valid in DNS but problematic in zone files (e.g., dots, quotes).

Suggested Fix

Quote or escape special characters in hostname output

LOWUnnecessary package installation in containers

molecule/default/prepare.yml:13

[AGENTS: Harbor]containers

Bootstrap script installs sudo and python3 which may not be required for all test scenarios.

Suggested Fix

Review package requirements and install only what's needed for specific test profiles

LOWNamed.root File Download Without Validation

tasks/main.yml:30

[AGENTS: Infiltrator]attack_surface

The role downloads named.root hints from bind_named_root_url (defaults to internic.net) without HTTPS-only enforcement or validation. While the default URL uses HTTPS, there's no validation of the source.

Suggested Fix

Enforce HTTPS-only downloads and validate the source URL against a trusted allowlist.

LOWMissing TLS cipher validation

tasks/tls.yml:26

[AGENTS: Gateway]configuration

TLS configuration uses bind_tls_ciphers variable but there's no validation that the cipher string is properly formatted or that weak ciphers are explicitly excluded. The default in vars/main.yml is restrictive but should be validated.

Suggested Fix

Add validation to ensure cipher string includes !aNULL, !eNULL, !RC4, !3DES, !MD5, !EXP, !PSK, !SRP, !DSS, !SHA1 exclusions.

LOWTLS key file paths exposed in error messages

tasks/tls.yml:35

[AGENTS: Fuse]error_disclosure

Error messages could potentially leak sensitive file paths related to TLS certificates and keys. While not critical, this could aid reconnaissance.

Suggested Fix

Add logging configuration to exclude sensitive file paths from error output

LOWTLS cipher suite could be more restrictive

vars/main.yml:3

[AGENTS: Cipher]cryptography

The cipher suite configuration allows SHA256 and SHA384 which are acceptable, but could explicitly specify modern AEAD ciphers like CHACHA20-POLY1305 and AES-GCM.

Suggested Fix

Update bind_tls_ciphers to explicitly include modern AEAD ciphers: "HIGH:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384:!SHA512:!AES128:!AES256:!CAMELLIA:!SEED:!DES-CBC3-SHA:!DES-CBC-SHA:!DES-CBC-SHA128:!DES-CBC-SHA256:!DES-CBC-SHA384:!DES-CBC-SHA512:!DES-CBC-SHA128-SHA256:!DES-CBC-SHA256-SHA384:!DES-CBC-SHA384-SHA512:!DES-CBC-SHA512-SHA256:!DES-CBC-SHA512-SHA384:!DES-CBC-SHA512-SHA512"

CRITICALUnauthenticated External URL Download - SSRF/Data Exfiltration Risk

files/update-rpz.sh:15

[AGENTS: Infiltrator]attack_surface

The update-rpz.sh script downloads zone files from URLs provided in bind_response_policy_zones configuration without any authentication or validation. An attacker who can modify RPZ zone URLs can perform SSRF attacks, exfiltrate data, or redirect traffic to malicious servers.

Suggested Fix

Implement URL validation, allowlist of trusted domains, and add authentication headers. Consider using signed URLs or token-based authentication for zone file downloads.

Summary

Consensus from 36 reviewer(s): Razor, Pedant, Chaos, Sentinel, Specter, Blacklist, Syringe, Sanitizer, Vault, Gatekeeper, Deadbolt, Passkey, Cipher, Warden, Compliance, Entropy, Phantom, Siege, Lockdown, Gateway, Harbor, Tripwire, Trace, Supply, Infiltrator, Fuse, Recon, Vector, Provenance, Prompt, Wallet, Mirage, Weights, Exploit, Tenant, Egress Total findings: 50 Severity breakdown: 1 critical, 13 high, 28 medium, 8 low

Note: Fixing issues can create a domino effect — resolving one finding often surfaces new ones that were previously hidden. Multiple scan-and-fix cycles may be needed until you’re satisfied no further issues remain. How deep you go is your call.