CVE-2021-33516

Vulnerability

GUPnP versions before 1.0.7 and 1.2.5 (including 1.1.x and 1.2.x prior to 1.2.5) lack proper validation of the HTTP Host header, allowing DNS rebinding attacks. This flaw enables a remote web server to trick a victim's browser into sending requests to local UPnP services implemented with GUPnP. [1]

Exploitation

An attacker needs to host a malicious website and lure a victim into visiting it. The victim's browser, due to DNS rebinding, resolves the attacker's domain to a local IP address, causing requests to be sent to UPnP services on the victim's network. No authentication is required from the attacker's side. The attack proceeds when the victim's browser interacts with the malicious site, which triggers actions against local UPnP services. [1]

Impact

Successful exploitation allows the attacker to perform unauthorized actions on local UPnP services, such as data exfiltration (reading sensitive information) or data tampering (modifying data or device state). The exact impact depends on the specific UPnP service exposed. [1]

Mitigation

The vulnerability is fixed in GUPnP versions 1.0.7 and 1.2.5, released on May 24, 2021. Upgrading to these versions or later is strongly recommended. As a workaround, using a DNS resolver that prevents DNS rebinding can mitigate the attack. Note that the fix may cause compatibility issues with older, non-compliant UPnP clients. [1]