Dns Cache Poisoning in Fastapi (Python)

DNS cache poisoning (also known as DNS spoofing) occurs when an attacker injects false DNS records into a resolver's cache, causing clients to resolve a legitimate domain to a malicious IP address. While this attack targets DNS infrastructure, FastAPI applications can be exposed if they rely on DNS-resolved hostnames for external API calls, service discovery, or outbound requests without proper validation. For example, a FastAPI endpoint that fetches data from an external service using a hostname (e.g., api.payment-provider.com) could be tricked into sending sensitive data to an attacker-controlled server if the DNS cache is poisoned.

FastAPI’s asynchronous nature and common use of httpx.AsyncClient or requests for outbound HTTP calls increase exposure if DNS validation is not enforced. The vulnerability is not in FastAPI itself but in how the application handles outbound trust. If the application does not verify the TLS certificate hostname matches the expected service (e.g., using verify=True and proper SNI), or if it uses HTTP instead of HTTPS, a poisoned DNS response can lead to man-in-the-middle attacks. Real-world parallels include CVE-2020-1350 (SIGRed), a wormable DNS vulnerability in Windows DNS servers, showing how cache poisoning can be exploited at scale.

middleBrick’s black-box scanning detects such risks by testing unauthenticated outbound request patterns and identifying missing hostname validation or insecure transport in API dependencies. It flags findings under the 'Data Exposure' and 'Encryption' categories when APIs make external calls without verifying destination authenticity.

The primary defense against DNS cache poisoning in outbound FastAPI calls is to enforce strict TLS hostname verification and avoid reliance on DNS-only trust. Use httpx with explicit verify and cert parameters, and always validate the service identity via HTTPS. Never use HTTP for sensitive external calls.

Example: Secure outbound request to a payment API with hostname verification:

import httpx
from fastapi import FastAPI

app = FastAPI()

@app.get("/process-payment/")
async def process_payment():
    # Use HTTPS and enforce hostname verification
    async with httpx.AsyncClient(verify=True) as client:
        try:
            response = await client.get(
                "https://api.payment-provider.com/charge",
                params={"amount": 100},
                timeout=10.0
            )
            response.raise_for_status()
            return response.json()
        except httpx.RequestError as exc:
            # Log error but do not expose internal details
            return {"error": "Payment service unavailable"}
        except httpx.HTTPStatusError as exc:
            return {"error": f"Payment failed: {exc.response.status_code}"}

# Optional: Use a fixed IP with Host header for extra control (not a DNS bypass)
async def process_payment_with_host_header():
    async with httpx.AsyncClient(verify=True) as client:
        response = await client.get(
            "https://192.0.2.10/charge",  # Known good IP
            headers={"Host": "api.payment-provider.com"},
            params={"amount": 100}
        )
        return response.json()

Additional measures:

• Use internal service meshes or private DNS zones with DNSSEC where possible.
• Implement outbound proxy allowlists (e.g., via AWS VPC endpoints or service mesh policies).
• Log and alert on DNS resolution anomalies via cloud provider security tools (e.g., AWS Route 53 Resolver DNS Firewall).
• Never disable verify=True in production — this is a common misconfiguration middleBrick detects under 'Encryption' findings.

These fixes ensure that even if DNS is poisoned, the TLS handshake will fail due to hostname mismatch, preventing data exfiltration. middleBrick validates these protections by scanning for missing verification in external calls and reporting them as actionable findings.