# DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)

macOS resolves http://0.0.0.0 via .local mDNS, letting an attacker DNS server bypass Node.js --inspect rebinding protection and reach the debugger for RCE.

- Payout: $4,200
- Severity: high
- Program: Internet Bug Bounty
- Found by: zeyu2001
- Disclosed: 2023-01-12
- CVE: CVE-2022-32212, CVE-2018-7160
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1714979
- Library page: https://bugbountylibrary.com/r/h1%3A1714979
- Tags: area:web domain:oss domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:nodejs technique:incomplete-fix technique:source-review vuln:access-control vuln:rce

**Target:** Node.js inspector/debugger HTTP endpoint (--inspect)
**Root cause:** The CVE-2022-32212 fix only blocked routable IP addresses; on macOS the http://0.0.0.0 URL is handled specially and hosts in the .local domain are resolved via mDNS, so an attacker-controlled DNS server can still rebind to arbitrary IPs.
**Steps:**
1. Victim runs Node.js with --inspect, exposing the debugger on localhost.
2. Attacker lures victim's browser to an attacker page.
3. Attacker-controlled DNS server resolves `<Computer Name>.local` to an arbitrary IP address.
4. Browser loads attacker content at `http://0.0.0.0`, bypassing the DNS rebinding protection added in CVE-2022-32212.
5. Attacker reaches the Node.js debugger and executes code.
**How found:** Reviewing the CVE-2022-32212 fix, the researcher noticed it only covered routable IP addresses and hypothesized a macOS-specific behavior for the http://0.0.0.0 URL involving .local domain resolution.
**Exploitation:** Attacker with a compromised or spoofable DNS server resolves `<Computer Name>.local` to an arbitrary IP, causing the victim browser to load attacker content at http://0.0.0.0 and access the Node.js debugger, leading to remote code execution.
**Insight:** When auditing a rebinding fix, check platform-specific URL/host handling (e.g. macOS mDNS .local resolution of 0.0.0.0) that the patch's IP-address checks don't cover.

## Write-ups of the same bug (oldest first)
- 2021-02-23: [DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)](https://bugbountylibrary.com/r/h1%3A1069487) — v6ak
- 2023-01-12: [DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)](https://bugbountylibrary.com/r/h1%3A1714979) — zeyu2001 (this one)