2

I work for a large Eastern European bank as a programmer.

Recently, I was setting up a documentation website for my team. We came up with the host name, and now all we needed was to pick the best suitable zone for it and send a request to IT support team to create a new DNS record.

So, I fired up PowerShell and loaded DnsServer module to list available DNS zones (I was unaware at the time, that ordinary users, generally, can not enumerate anything on AD DNS server. Access SHOULD be denied by default).

The Get-DnsServerZone cmdlet promptly listed all available zones. I've picked one, and to make sure there were no similar host names in this zone, ran Get-DnsServerResourceRecord command too. Everything worked fine.

While I was at it, out of curiosity, I decided to explore "Add-*" commands too: Add-DnsServerResourceRecordA, Add-DnsServerResourceRecordCName etc. I did not expect these to work at all, but, to my great surprise, cmdlets did not throw errors - they completed successfully!!!

I've verified created records using Get-DnsServerResourceRecord and nslookup. Also ran same commands using non-privileged technical user account (which belongs only to DOMAIN\Users group and nothing else) and got same result: DNS records were added successfully. Looks like any authenticated user can create DNS records. This does not feel right.

The Question:

Is this an acceptable practice or a security misconfiguration? Should I report it?

(I have not reported it yet, because of lots of beaurocracy involved. Also I dont want to attract unneeded attention. We have quite unhealthy culture and broken communication here - this is a bank, after all).

Improve this question

2 Answers 2

Reset to default
2

This should definitely be reported to your CSO and/or his/her team.

Besides you being able to add DNS records, chances are good, that you can execute other commands as well to manipulate the DNS configuration. From my experience it is better to report findings like this fast.

If the network administrators in charge notice the alterations that you have made, they will most likely be able to trace them back to you. If you have not reported this incident to them by then (or even in a timeframe that acceptably small), this will put you in a far worse light than reporting the issue in the first place.

Improve this answer
2
  • Thanks for answer! Although I must say about "user account with too many rights": as I mentioned in the question, I have tried same command using another throwaway technical user, and it worked. Most likely this is a case of ill-configured DNS server.
    – Julak Doom
    Feb 14, 2018 at 15:45
  • Ah, sorry. Read over that line. My mistake.
    – Tom K.
    Feb 14, 2018 at 15:48
1

Authenticated users by default have the create child object permission. Removing this breaks ddns.

Related Technet post

Improve this answer
1
  • Thanks, I've googled DDNS and this one seems legitimate concern too. This is confusing. But I've decided to report it anyways.
    – Julak Doom
    Feb 14, 2018 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .