860
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1214 Data Integrity Issues 2477
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
An attacker could utilize the untrusted data source to
bypass protection mechanisms and gain access to
sensitive data.
Demonstrative Examples
Example 1:
This code attempts to limit the access of a page to certain IP Addresses. It checks the
'HTTP_X_FORWARDED_FOR' header in case an authorized user is sending the request through a
proxy.
Example Language: PHP (Bad)
$requestingIP = '0.0.0.0';
if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {
$requestingIP = $_SERVER['HTTP_X_FORWARDED_FOR'];
else{
$requestingIP = $_SERVER['REMOTE_ADDR'];
}
if(in_array($requestingIP,$ipAllowlist)){
generatePage();
return;
}
else{
echo "You are not authorized to view this page";
return;
}
The 'HTTP_X_FORWARDED_FOR' header can be user controlled and so should never be trusted.
An attacker can falsify the header to gain access to the page.
This fixed code only trusts the 'REMOTE_ADDR' header and so avoids the issue:
Example Language: PHP (Good)
$requestingIP = '0.0.0.0';
if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {
echo "This application cannot be accessed through a proxy.";
return;
else{
$requestingIP = $_SERVER['REMOTE_ADDR'];
}
...
Be aware that 'REMOTE_ADDR' can still be spoofed. This may seem useless because the server
will send the response to the fake address and not the attacker, but this may still be enough to
CWE Version 4.14
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data