AIKIDO-2024-10491

TL;DR

In Lightbend Akka versions prior to 2.8.1, the async-dns resolver (used by Akka Discovery in DNS mode and transitively by Akka Cluster Bootstrap) generates predictable DNS transaction IDs, making DNS resolution vulnerable to poisoning attacks. An attacker can forge DNS responses with matching transaction IDs, redirecting traffic to malicious endpoints. If the application does not validate the authenticity of discovered services (e.g., via TLS), this can lead to data exfiltration, such as persistence events being published to an unintended Kafka broker. If validation is in place, the attack results in a denial of access to the intended service.