706
The authentication mechanism implemented relies on an IP address for source validation. If an
attacker is able to spoof the IP, they may be able to bypass the authentication mechanism.
Example 2:
Both of these examples check if a request is from a trusted address before responding to the
request.
Example Language: C (Bad)
sd = socket(AF_INET, SOCK_DGRAM, 0);
serv.sin_family = AF_INET;
serv.sin_addr.s_addr = htonl(INADDR_ANY);
servr.sin_port = htons(1008);
bind(sd, (struct sockaddr *) & serv, sizeof(serv));
while (1) {
memset(msg, 0x0, MAX_MSG);
clilen = sizeof(cli);
if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) {
n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);
}
}
Example Language: Java (Bad)
while(true) {
DatagramPacket rp=new DatagramPacket(rData,rData.length);
outSock.receive(rp);
String in = new String(p.getData(),0, rp.getLength());
InetAddress clientIPAddress = rp.getAddress();
int port = rp.getPort();
if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) {
out = secret.getBytes();
DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp);
}
}
The code only verifies the address as stored in the request packet. An attacker can spoof this
address, thus impersonating a trusted client.
Example 3:
The following code samples use a DNS lookup in order to decide whether or not an inbound
request is from a trusted host. If an attacker can poison the DNS cache, they can gain trusted
status.
Example Language: C (Bad)
struct hostent *hp;struct in_addr myaddr;
char* tHost = "trustme.example.com";
myaddr.s_addr=inet_addr(ip_addr_string);
hp = gethostbyaddr((char *) &myaddr, sizeof(struct in_addr), AF_INET);
if (hp && !strncmp(hp->h_name, tHost, sizeof(tHost))) {
trusted = true;
} else {
trusted = false;
}
Example Language: Java (Bad)
String ip = request.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
if (addr.getCanonicalHostName().endsWith("trustme.com")) {
trusted = true;
}
CWE Version 4.14
CWE-290: Authentication Bypass by Spoofing
CWE-290: Authentication Bypass by Spoofing