# Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

Hickory recursor cached AUTHORITY-section NS records using parent-zone bailiwick, letting an attacker-controlled sibling zone poison victim.poc. NS and hijack its resolution.

- Payout: Research
- Severity: high
- Program: Hickory DNS
- Found by: qifan-sailboat
- Disclosed: 2026-04-30
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-83hf-93m4-rgwq
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-83hf-93m4-rgwq
- Tags: area:devices domain:network impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:rust technique:source-review vuln:cache-poisoning

**Target:** hickory-recursor DnsLru record cache / recursive resolver
**Root cause:** cache_response() inserts ANSWER/AUTHORITY/ADDITIONAL records keyed by each record's own (name,type) rather than the originating query, and the bailiwick check uses the NS pool's zone context (parent 'poc.') instead of the queried zone, so a sibling zone's NS record passes is_subzone().
**Steps:**
1. Attacker controls nameserver for attacker.poc. under parent zone poc.
2. Query attacker.poc. NS; Hickory builds NS pool using parent poc. pool (ns.zone()='poc.').
3. Attacker's nameserver responds with AUTHORITY section containing `victim.poc. NS ns.evil.poc.`.
4. Bailiwick check `is_subzone("poc.", "victim.poc.")` passes; record cached under (victim.poc., NS).
5. Client queries a name in victim.poc.; Hickory builds NS pool from poisoned cache and sends queries to ns.evil.poc. instead of the legitimate NS.
**How found:** Reporter observed that cache insertion keys records by their own (name,type) and that the bailiwick filter uses the NS pool's zone context rather than the queried zone, then reasoned that a parent-pool lookup for a sibling zone would pass is_subzone() and poison the shared cache.
**Exploitation:** Attacker needs control of a nameserver for a subdomain of a shared parent zone and the ability to answer queries for it. By injecting a sibling zone's NS record in the AUTHORITY section, the shared cache is poisoned so all subsequent resolutions for the victim sibling zone are routed to the attacker's nameserver, enabling full response forgery for that zone.
**Escalation:** Poisoning one sibling zone's NS entry redirects all resolution for that zone to attacker infrastructure, allowing arbitrary forged answers for any name in victim.poc.
**Insight:** When auditing recursive resolvers, check whether cache keys derive from the record itself vs the originating query, and whether bailiwick checks use the pool's zone context instead of the queried name's zone — sibling zones under a shared parent are the classic bypass.