Critical Akamai CVE-2024-20780 Lets Attackers Bypass DNS Filtering

Key Takeaways

• A new technique called “Underminr” allows attackers to bypass protective DNS filtering by exploiting shared CDN infrastructure.
• The method enables malicious traffic to masquerade as legitimate connections to trusted domains.
• CVE-2024-20780 affects Akamai Prolexic and Kona Site Defender, rated with a CVSS score of 7.5 (High).
• Attackers can use Underminr for C2 communication, data exfiltration, and policy circumvention.
• Mitigation involves correlating DNS queries with actual connection endpoints and monitoring for suspicious activity.

Attackers Bypass DNS Filtering Using Shared CDN Infrastructure

Cybersecurity researchers at ADAMnetworks have unveiled a sophisticated method that allows malicious actors to circumvent protective DNS filtering by leveraging shared Content Delivery Network (CDN) infrastructure. This technique, dubbed “Underminr,” enables attackers to conceal nefarious traffic behind seemingly legitimate domains, posing a significant challenge to conventional network defenses.

Underminr exploits vulnerabilities in how security systems validate DNS requests, TLS connections, and CDN edge routing. This allows attackers to establish connections that appear benign while secretly communicating with malicious destinations. The method targets a critical blind spot in enterprise security, where the actual encrypted connection can be redirected to a malicious domain, even if the initial DNS resolution points to a trusted site.

How Underminr Works

In typical scenarios, a user’s system might resolve a legitimate domain, such as whatismyipaddress.com, which is permitted by protective DNS (PDNS). However, Underminr redirects the subsequent encrypted connection to a different, malicious domain, for example, evilsite.ai, which shares the same CDN edge IP address. This redirection often goes unnoticed because many enterprise defenses primarily rely on DNS reputation or initial TLS inspection, failing to detect the mismatch between the resolved DNS and the final connection target.

Unlike older domain fronting techniques, which major cloud providers largely mitigated around 2018, Underminr manipulates Server Name Indication (SNI) and HTTP Host headers while utilizing authentic DNS responses. This makes detection and blocking considerably more difficult. ADAMnetworks researchers have observed that attackers can implement this technique using simple scripts, malware, or social engineering tactics like “ClickFix” attacks, which trick users into executing local commands.

Impact and Attack Modes

Once active, Underminr facilitates a wide array of malicious activities, including command-and-control (C2) communication, data exfiltration, VPN tunneling, and policy circumvention. All these activities appear as normal traffic to trusted services, making them difficult to flag. The research identifies four primary attack modes:

• Simple Mode: Employs a deceptive SNI after a legitimate DNS lookup.
• Split Mode: Initiates a benign connection, then switches to a malicious one to evade deep packet inspection (DPI).
• ECH Mode: Utilizes Encrypted Client Hello (ECH) to completely obscure SNI details.
• Direct-to-IP Mode: Bypasses DNS logging entirely by connecting directly to CDN edge IPs.

These techniques align with established MITRE ATT&CK methods, specifically protocol tunneling and the abuse of external remote services. Underminr has been linked to advanced persistent threat (APT) groups, including China-aligned actors such as Flax Typhoon and GALLIUM, who have historically used tools like SoftEther VPN for persistence and evasion.

The broader implications are substantial, as protective DNS, a cornerstone of many security strategies, can be rendered ineffective without more profound traffic correlation. ADAMnetworks warns that organizations relying solely on DNS filtering or partial TLS inspection are particularly susceptible, especially those without full proxying or traffic decryption capabilities.

Akamai Vulnerability CVE-2024-20780

Akamai has acknowledged a critical vulnerability, CVE-2024-20780, related to the Underminr technique. This flaw, with a CVSS score of 7.5 (High), affects Akamai Prolexic and Kona Site Defender. It specifically pertains to issues where the hostname presented in the SNI during a TLS handshake does not match the hostname in the HTTP Host header, allowing for the bypass of security policies.

Akamai has released updates to address CVE-2024-20780. Customers using Prolexic and Kona Site Defender should ensure their configurations are updated to the latest versions to mitigate this risk. The company advises customers to leverage the latest security rules and configurations to prevent policy bypasses.

What You Should Do

• Correlate DNS and Connection Metadata: Implement systems that correlate DNS queries with actual connection metadata, including SNI and HTTP Host headers, to detect mismatches.
• Monitor Connection Endpoints: Actively monitor the true endpoints of all network connections, rather than relying solely on initial DNS resolution.
• Enable Full TLS Inspection: Deploy full TLS proxying or traffic decryption where feasible to gain visibility into encrypted traffic.
• Stay Updated: Ensure all security products, especially those from Akamai (Prolexic, Kona Site Defender), are updated to the latest versions to address CVE-2024-20780.
• Utilize Threat Intelligence: Leverage threat intelligence from initiatives like ADAMnetworks’ new sharing program to identify vulnerable domains or those being abused.
• Educate Users: Implement robust user education programs to mitigate social engineering attacks like ClickFix, which can initiate Underminr techniques.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.