Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing
This work highlights a critical security flaw in DNS-derived IP authorization, affecting a broad range of shared hosting and CDN providers, and provides a foundation for improving access-control mechanisms.
The authors identify a validation gap in DNS-based authorization in shared hosting and CDN environments, enabling the Domain Decoupling Attack (DDA) that bypasses access controls by reusing permissions from an allowed domain to reach other tenants. Measurements across 1,069,048 domains show exposure rates of 95.8% overall, 99.26% for CDN, and 92.75% for non-CDN domains.
Network attackers often conceal malicious communication within legitimate Internet traffic. Existing CDN-based evasion techniques rely on SNI--Host inconsistency, insufficient domain ownership verification, or provider-specific routing rewrites, which limit their applicability in modern CDN environments. We identify a validation gap in DNS-based authorization, where permission derived from an allowed domain applies to a shared IP and can be reused to reach another tenant in both CDN and non-CDN shared-hosting environments. This paper presents the Domain Decoupling Attack (DDA), which resolves an allowed domain to obtain permission for a shared edge IP and subsequently connects to the same address while presenting the hidden domain consistently in both TLS SNI and HTTP Host. Measurements of 1,069,048 domains across six continents produce 18,025,068 successful probes and identify exposure rates of 95.8% overall, 99.26% for CDN domains, 92.75% for non-CDN domains, and 97.7% for non-CDN cross-tenant IPs, while laboratory experiments reveal a structural limitation of DNS-bound access control on shared addresses. These results clarify the security risks of DNS-derived IP authorization and support the evaluation and improvement of access-control mechanisms in CDN and non-CDN shared-hosting environments.