1719
}
Example Language: Java (Bad)
String ip = request.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
if (addr.getCanonicalHostName().endsWith("trustme.com")) {
trusted = true;
}
Example Language: C# (Bad)
IPAddress hostIPAddress = IPAddress.Parse(RemoteIpAddress);
IPHostEntry hostInfo = Dns.GetHostByAddress(hostIPAddress);
if (hostInfo.HostName.EndsWith("trustme.com")) {
trusted = true;
}
IP addresses are more reliable than DNS names, but they can also be spoofed. Attackers can
easily forge the source IP address of the packets they send, but response packets will return to the
forged IP address. To see the response packets, the attacker has to sniff the traffic between the
victim machine and the forged IP address. In order to accomplish the required sniffing, attackers
typically attempt to locate themselves on the same subnet as the victim machine. Attackers may
be able to circumvent this requirement by using source routing, but source routing is disabled
across much of the Internet today. In summary, IP address verification can be a useful part of an
authentication scheme, but it should not be the single factor required for authentication.
Observed Examples
Reference Description
CVE-2009-1549 Attacker can bypass authentication by setting a cookie to a specific value.
https://www.cve.org/CVERecord?id=CVE-2009-1549
CVE-2009-1619 Attacker can bypass authentication and gain admin privileges by setting an
"admin" cookie to 1.
https://www.cve.org/CVERecord?id=CVE-2009-1619
CVE-2009-0864 Content management system allows admin privileges by setting a "login"
cookie to "OK."
https://www.cve.org/CVERecord?id=CVE-2009-0864
CVE-2008-5784 e-dating application allows admin privileges by setting the admin cookie to 1.
https://www.cve.org/CVERecord?id=CVE-2008-5784
CVE-2008-6291 Web-based email list manager allows attackers to gain admin privileges by
setting a login cookie to "admin."
https://www.cve.org/CVERecord?id=CVE-2008-6291
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 803 2010 Top 25 - Porous Defenses 800 2355
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 866 2011 Top 25 - Porous Defenses 900 2372
MemberOf 878 CERT C++ Secure Coding Section 10 - Environment
(ENV)
868 2378
MemberOf 884 CWE Cross-section 884 2567
CWE Version 4.14
CWE-820: Missing Synchronization
CWE-820: Missing Synchronization