709
Scope Impact Likelihood
Access Control
Non-Repudiation
Hide Activities
Gain Privileges or Assume Identity
Malicious users can fake authentication information,
impersonating any IP address.
Potential Mitigations
Phase: Architecture and Design
Use other means of identity verification that cannot be simply spoofed. Possibilities include a
username/password or certificate.
Demonstrative Examples
Example 1:
Both of these examples check if a request is from a trusted address before responding to the
request.
Example Language: C (Bad)
sd = socket(AF_INET, SOCK_DGRAM, 0);
serv.sin_family = AF_INET;
serv.sin_addr.s_addr = htonl(INADDR_ANY);
servr.sin_port = htons(1008);
bind(sd, (struct sockaddr *) & serv, sizeof(serv));
while (1) {
memset(msg, 0x0, MAX_MSG);
clilen = sizeof(cli);
if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) {
n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);
}
}
Example Language: Java (Bad)
while(true) {
DatagramPacket rp=new DatagramPacket(rData,rData.length);
outSock.receive(rp);
String in = new String(p.getData(),0, rp.getLength());
InetAddress clientIPAddress = rp.getAddress();
int port = rp.getPort();
if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) {
out = secret.getBytes();
DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp);
}
}
The code only verifies the address as stored in the request packet. An attacker can spoof this
address, thus impersonating a trusted client.
Observed Examples
Reference Description
CVE-2022-30319 S-bus functionality in a home automation product performs access control
using an IP allowlist, which can be bypassed by a forged IP address.
https://www.cve.org/CVERecord?id=CVE-2022-30319
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-293: Using Referer Field for Authentication
CWE-293: Using Referer Field for Authentication