Dns Cache Poisoning in Aspnet (Csharp)

DNS cache poisoning (also known as DNS spoofing) manipulates a DNS resolver's cache to return a malicious IP address for a legitimate domain. When an ASP.NET Core application written in C# makes outbound HTTP requests—such as calling third-party APIs, fetching configuration, or integrating with external services—it relies on DNS resolution. If the underlying operating system or DNS resolver is compromised, the application may unknowingly connect to an attacker-controlled server.

ASP.NET Core itself does not perform DNS caching; it delegates resolution to the host OS via System.Net.Http.HttpClient or System.Net.Sockets.Socket. However, certain application patterns increase risk: hardcoding hostnames without validation, disabling certificate checks, or trusting internal DNS responses in zero-trust environments. For example, if an ASP.NET Core service resolves api.paymentprovider.com and the DNS cache is poisoned to point to attacker.com, any secrets sent in request headers or bodies could be exfiltrated.

This risk is amplified in cloud or containerized deployments where shared DNS infrastructure (like AWS VPC DNS or Kubernetes CoreDNS) is used. A successful cache poisoning attack could lead to SSRF-like scenarios where the ASP.NET application becomes a proxy for attacking internal services. middleBrick detects such risks by testing unauthenticated endpoints for outbound request behaviors and flaging domains that resolve to unexpected or private IP ranges after simulated DNS manipulation.

While ASP.NET Core cannot prevent DNS cache poisoning at the network layer, developers can mitigate impact through defensive coding practices. The following C# examples show how to reduce risk when making outbound HTTP requests.

First, always validate the resolved IP address against an allowlist before establishing a connection. This prevents communication with unintended endpoints even if DNS is compromised.

using System.Net;
using System.Net.Http;
using System.Threading.Tasks;

public class SecureHttpClient
{
    private static readonly HttpClient _httpClient = new HttpClient();
    private static readonly string[] AllowedIps = { "13.107.21.200", "40.112.72.205" }; // Example: Microsoft API IPs

    public async Task<HttpResponseMessage> GetSafeAsync(string url)
    {
        var uri = new Uri(url);
        var host = uri.Host;

        // Resolve hostname to IP addresses
        IPAddress[] addresses = Dns.GetHostAddresses(host);

        bool isAllowed = false;
        foreach (IPAddress ip in addresses)
        {
            if (Array.Exists(AllowedIps, allowed => allowed.Equals(ip.ToString())))
            {
                isAllowed = true;
                break;
            }
        }

        if (!isAllowed)
        {
            throw new InvalidOperationException($"Resolved IP for {host} is not in the allowlist.");
        }

        // Proceed with request
        return await _httpClient.GetAsync(url);
    }
}

Second, enforce certificate validation. Never disable ServerCertificateValidationCallback in production, as this would allow attackers to present valid certificates for poisoned domains.

// ❌ Dangerous: disables certificate validation
// HttpClientHandler handler = new HttpClientHandler()
// {
//     ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true
// };

// ✅ Safe: use default validation (no callback set)
HttpClient safeClient = new HttpClient();

Third, use IHttpClientFactory with named or typed clients to centralize configuration, including timeouts and handlers that can log or filter outgoing requests.

// In Startup.cs or Program.cs
builder.Services.AddHttpClient("PaymentApi", client
{
    client.BaseAddress = new Uri("https://api.paymentprovider.com/");
    client.Timeout = TimeSpan.FromSeconds(10);
});

// In service
public class PaymentService
{
    private readonly IHttpClientFactory _clientFactory;
    public PaymentService(IHttpClientFactory clientFactory)
    {
        _clientFactory = clientFactory;
    }

    public async Task<string> ProcessPaymentAsync()
    {
        var client = _clientFactory.CreateClient("PaymentApi");
        HttpResponseMessage response = await client.GetAsync("charge");
        response.EnsureSuccessStatusCode();
        return await response.Content.ReadAsStringAsync();
    }
}

These controls do not fix DNS poisoning but ensure that even if resolution is compromised, the application will not communicate with unverified endpoints. middleBrick’s runtime scanning can validate whether your ASP.NET Core endpoints exhibit unsafe outbound behavior, such as connecting to private IP ranges or ignoring TLS errors, providing actionable findings in its reports.