GHSA-MXWC-WH95-PW4G: Denial of Service via Uncontrolled Recursion in Trapster DNS Parser

The trapster package is an open-source, Python-based honeypot framework designed to detect malicious network scanning and reconnaissance activity. It emulates multiple network services, exposing specialized listeners that collect incoming payloads and catalog attacking hosts.

Among its modules is a Domain Name System (DNS) honeypot listener. This listener binds to a specified UDP interface and port, processing unauthenticated packets directly from the network. Because of its exposed nature, this listener represents a primary attack surface for any remote, unauthenticated threat actor targeting the system.

A severe flaw in the DNS parser allows attackers to crash the honeypot handler remotely. The vulnerability stems from uncontrolled recursion (CWE-674) within the packet-parsing logic of the DNS module. By sending carefully crafted DNS packets, a remote attacker can exhaust system resources and render the honeypot completely non-functional.

To optimize packet sizes, RFC 1035 specifies a mechanism called DNS name compression. Instead of repeating identical domain name labels, the protocol permits a label to point to a prior offset within the same message where the domain name is already defined. A compression pointer is identified when the first two bits of a length byte are set to 11 (binary 11000000 or hex 0xC0).

The vulnerability resides in the decode_labels() function inside trapster/libs/dns.py. When encountering the 0xC0 byte sequence, the function extracts the target offset and recursively calls decode_labels() to resolve the compressed string. It fails to maintain state or verify whether the target offset has already been processed during the execution of the current request.

Because there is no cycle detection or recursion limit, an attacker can exploit this omission by passing a circular reference. Additionally, the parser does not enforce a recursion depth limit, meaning even non-cyclic but highly chained pointer offsets can trigger a stack overflow. When CPython encounters these inputs, it raises a RecursionError and halts processing.

An analysis of the vulnerable source code in trapster/libs/dns.py reveals the following structural implementation:

def decode_labels(message, offset):
    labels = []
    while True:
        length, = struct.unpack_from("!B", message, offset)
        if (length & 0xC0) == 0xC0:
            pointer, = struct.unpack_from("!H", message, offset)
            offset += 2
            # Vulnerable recursive call
            return labels + decode_labels(message, pointer & 0x3FFF), offset

The recursive call decode_labels(message, pointer & 0x3FFF) accepts any arbitrary offset parsed from the network packet without enforcing any upper boundaries or monotonic progression restrictions. An attacker-controlled pointer can point backwards, forwards, or to itself, leading to infinite loops or deep exhaustion of the stack.

To remediate this root cause, the function must be refactored into an iterative structure. A safe implementation tracks the maximum allowed offset, ensuring that any subsequent compression pointer strictly references a decreasing index within the packet byte array, thereby preventing cycles entirely. The following code snippet shows a robust, hardened iterative version:

def decode_labels(message, offset):
    labels = []
    return_offset = None
    max_allowed_pointer = len(message)
    while True:
        length, = struct.unpack_from("!B", message, offset)
        if (length & 0xC0) == 0xC0:
            pointer, = struct.unpack_from("!H", message, offset)
            if return_offset is None:
                return_offset = offset + 2
            target = pointer & 0x3FFF
            if target >= max_allowed_pointer:
                raise ValueError("invalid DNS compression pointer")
            max_allowed_pointer = target
            offset = target
            continue

Exploitation of this vulnerability is highly operationalizable and requires zero prerequisites. Because the honeypot binds to a public-facing UDP port to catch scanning attempts, the attack payload can be delivered in a single, unauthenticated UDP packet.

The first vector (Vector A) employs a self-referential compression pointer. The attacker builds a DNS query where a label pointer references its own offset (for example, offset 12). When the parser reads offset 12, it encounters 0xC00C, leading to an immediate loop that exhausts Python's recursion limit.

The second vector (Vector B) constructs a deep pointer chain. The packet contains a highly nested list of pointers that link to one another sequentially. This allows an attacker to trigger a stack crash even if the implementation checks for direct circular references, as the cumulative recursion depth exceeds Python's default stack frame limit.

Because the DNS server implementation in trapster fails to capture parsing-related exceptions inside DnsUdpProtocol.datagram_received(), the raised RecursionError escapes the task handler and propagates to the main asyncio event loop. This leads to thread instability, massive log generation, and a persistent Denial of Service.

While this vulnerability does not allow remote code execution or unauthorized access to system data, its security impact remains highly significant for monitoring infrastructure. The primary consequence is a complete Denial of Service (DoS) of the DNS honeypot listener.

Honeypots serve as a critical early warning system for enterprise networks, logging pre-attack scanning and mapping active threats. By disabling the trapster listener, an attacker can blind the security team, executing subsequent attacks and scanning networks without triggering alerts.

The CVSS v3.1 base score is assessed at 5.3, with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. Although the availability impact is classified as low under standard CVSS metrics because it does not crash the host operating system, it completely neutralizes the functional utility of the security tool.

Remediation of this vulnerability requires updating the DNS module to use an iterative label parsing algorithm. Security administrators should deploy the iterative refactoring of decode_labels() as shown in the code analysis section to prevent pointer loops.

In addition to parsing corrections, the core network listener in trapster/modules/dns.py must be hardened. The calling logic should handle parsing errors locally instead of allowing raw exceptions to escape into the underlying event loop. The protocol handler should wrap the decode sequence in a standard try-except structure:

try:
    message = dns.decode_dns_message(data)
except (ValueError, IndexError, struct.error) as err:
    self.logger.warning(f"Malformed DNS packet received: {err}")
    return

Implementing both the iterative parser and local exception containment provides complete protection against variant compression attacks and ensures service stability during hostile network exposure.