T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:22
- Finding
- Privileged DNS Traffic Interception and Broad UDP/443 Blocking## Vulnerability Details **File Location**: `SKILL.md`, line 22 **Vulnerability Type**: `T05: Skill Instruction Hijacking` **Risk Level**: Medium ### Evidence ```text | `enforce` | `agentic-dns enforce <on\|off\|status\|clean> [target_ip]` | Intercept encrypted DNS (DoT port 853 -> pihole, DROP DoQ UDP/443). | ``` ### Technical Analysis The documented `enforce` command modifies network traffic handling by redirecting DNS-over-TLS traffic on TCP port 853 to Pi-hole and dropping UDP traffic on port 443. Firewall or packet-filter changes of this kind generally require elevated system privileges and affect traffic outside the invoking process. Dropping UDP/443 is broader than blocking only DNS-over-QUIC because UDP/443 is also commonly used by QUIC and HTTP/3. Without destination, process, interface, or protocol-aware restrictions, this rule may interrupt unrelated applications and network services. The documentation does not mention authorization checks, user confirmation, rule previews, scope limitations, backups, or automatic rollback. The package contains only `SKILL.md`; the `agentic-dns` implementation is absent. Consequently, the exact firewall commands, privilege acquisition mechanism, authentication controls, and validation behavior cannot be verified. The finding is limited to the privileged and broadly scoped behavior explicitly advertised by the Skill documentation. ### Attack Path 1. An agent loads the Skill and uses it to investigate a DNS connectivity problem. 2. The agent invokes `agentic-dns enforce on`, optionally with a target address. 3. If the external implementation runs with sufficient privileges, it installs traffic-redirection and UDP/443 filtering rules. 4. DNS-over-TLS traffic is redirected to Pi-hole, while affected UDP/443 traffic is dropped. 5. The modified rules may remain active until explicitly disabled or cleaned, disrupting encrypted DNS, QUIC, or HTTP/3 traffic within the rules' s ...[truncated 868 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user confirmation before installing, changing, or removing firewall rules. 2. Display the exact proposed rules, affected interfaces, addresses, ports, and expected side effects before applying them. 3. Use least privilege, granting only narrowly defined firewall-management capabilities rather than unrestricted root execution. 4. Restrict blocking rules to verified DNS-over-QUIC destinations where feasible; do not use a blanket UDP/443 drop rule. 5. Scope redirection by destination address, interface, network namespace, or designated client rather than applying system-wide interception by default. 6. Validate `target_ip` as an IP address and pass it through structured firewall APIs or safely quoted argument arrays. 7. Save the prior firewall state, apply changes transactionally, and provide automatic rollback on failure, timeout, or process termination. 8. Tag created rules uniquely so that `off` and `clean` remove only rules owned by this tool. 9. Document the exact privilege requirements, rule lifetime, traffic scope, and expected effect on QUIC and HTTP/3. 10. Include the executable implementation in the reviewable package so its authorization, input validation, firewall operations, and cleanup behavior can be audited.