707
Example Language: C# (Bad)
IPAddress hostIPAddress = IPAddress.Parse(RemoteIpAddress);
IPHostEntry hostInfo = Dns.GetHostByAddress(hostIPAddress);
if (hostInfo.HostName.EndsWith("trustme.com")) {
trusted = true;
}
IP addresses are more reliable than DNS names, but they can also be spoofed. Attackers can
easily forge the source IP address of the packets they send, but response packets will return to the
forged IP address. To see the response packets, the attacker has to sniff the traffic between the
victim machine and the forged IP address. In order to accomplish the required sniffing, attackers
typically attempt to locate themselves on the same subnet as the victim machine. Attackers may
be able to circumvent this requirement by using source routing, but source routing is disabled
across much of the Internet today. In summary, IP address verification can be a useful part of an
authentication scheme, but it should not be the single factor required for authentication.
Observed Examples
Reference Description
CVE-2022-30319 S-bus functionality in a home automation product performs access control
using an IP allowlist, which can be bypassed by a forged IP address.
https://www.cve.org/CVERecord?id=CVE-2022-30319
CVE-2009-1048 VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
https://www.cve.org/CVERecord?id=CVE-2009-1048
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 956 SFP Secondary Cluster: Channel Attack 888 2397
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
This can be resultant from insufficient verification.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Authentication bypass by spoofing
Related Attack Patterns
CAPEC-ID Attack Pattern Name
21 Exploitation of Trusted Identifiers
22 Exploiting Trust in Client
59 Session Credential Falsification through Prediction
60 Reusing Session IDs (aka Session Replay)
94 Adversary in the Middle (AiTM)
459 Creating a Rogue Certification Authority Certificate
461 Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
473 Signature Spoof
CWE Version 4.14
CWE-291: Reliance on IP Address for Authentication
CWE-291: Reliance on IP Address for Authentication