Cloudflare Public Bug Bounty · Report #1724464
cd=false (DNSSEC) not respected in DNS over HTTPS JSON requests
Validstatus
lowseverity
$250bounty
23upvotes
12 Dec 2022disclosed
Summary
The value of the cd (check disabled) flag was not correctly validated in DNS-over-HTTPS JSON API requests to cloudflare-dns.com.
In result, despite explicitly setting the flag value to 0 or false (according to the Cloudflare 1.1.1.1 documentation) the DNSSEC verification was not enforced for an unaware end user.
The fix was released by Cloudflare Engineering team and the flag in question is now validated properly.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.