864
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Bypass Protection Mechanism
Malicious users can fake authentication information by
providing false DNS information.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Use other means of identity verification that cannot be simply spoofed. Possibilities include a
username/password or certificate.
Phase: Implementation
Perform proper forward and reverse DNS lookups to detect DNS spoofing.
Demonstrative Examples
Example 1:
The following code samples use a DNS lookup in order to decide whether or not an inbound
request is from a trusted host. If an attacker can poison the DNS cache, they can gain trusted
status.
Example Language: C (Bad)
struct hostent *hp;struct in_addr myaddr;
char* tHost = "trustme.example.com";
myaddr.s_addr=inet_addr(ip_addr_string);
hp = gethostbyaddr((char *) &myaddr, sizeof(struct in_addr), AF_INET);
if (hp && !strncmp(hp->h_name, tHost, sizeof(tHost))) {
trusted = true;
} else {
trusted = false;
}
Example Language: Java (Bad)
String ip = request.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
if (addr.getCanonicalHostName().endsWith("trustme.com")) {
trusted = true;
}
Example Language: C# (Bad)
IPAddress hostIPAddress = IPAddress.Parse(RemoteIpAddress);
IPHostEntry hostInfo = Dns.GetHostByAddress(hostIPAddress);
if (hostInfo.HostName.EndsWith("trustme.com")) {
trusted = true;
}
CWE Version 4.14
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action