Underminr Flaw Lets Attackers Hide Malicious Connections on Shared CDNs
Summary
ADAMnetworks reports that attackers are exploiting Underminr, a shared-CDN routing flaw, to conceal connections to malicious domains and evade Protective DNS. The company estimates about 88 million domains could be affected.
Key points
- ADAMnetworks reports exploitation of Underminr, a variant of domain fronting affecting shared CDN infrastructure.
- The technique uses a domain’s SNI and HTTP Host while directing requests to another tenant’s IP address on the same shared edge.
- Attackers can use it to conceal connections to command-and-control servers, VPNs, and proxies, and to bypass network egress policies.
- The company says four strategies can use the flaw to circumvent Protective DNS monitoring and filtering.
- Reported attack methods include malicious applications, shell scripts, and ClickFix attacks.
- ADAMnetworks estimates approximately 88 million domains could be affected, with US, UK, and Canadian infrastructure most impacted.
Article Details
- Vulnerability Types
- Domain-fronting variant involving shared CDN tenant routing
- Protective DNS (PDNS) filtering bypass
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
MITRE ATT&CK
People
Countries
CanadaThere are approximately 88 million domains potentially affected by Underminr, with internet infrastructure in the US, the UK, and Canada most impacted.United KingdomThere are approximately 88 million domains potentially affected by Underminr, with internet infrastructure in the US, the UK, and Canada most impacted.United StatesThere are approximately 88 million domains potentially affected by Underminr, with internet infrastructure in the US, the UK, and Canada most impacted.