BunkerWeb vulnerabilities

BunkerWeb prior to 1.6.13 has a vulnerability in the blacklist, greylist, and antibot modules that trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge.

In BunkerWeb versions 1.6.2 through 1.6.12, the BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, allowing low-privilege read-only accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.

A vulnerability in BunkerWeb and BunkerWeb PRO prior to versions 1.6.12 and 0.57 allows a low-privileged authenticated user to escalate privileges through improper validation of the Host header in the UI and API. The issue affects a configuration-dependent input processing path.