CWE-1327: Binding to an Unrestricted IP Address
Description
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
Submission Date :
Sept. 8, 2020, midnight
Modification Date :
2023-10-26 00:00:00+00:00
Organization :
Tennessee Technological University
Extended Description
When a server binds to the address 0.0.0.0, it allows connections from every IP address on the local machine, effectively exposing the server to every possible network. This might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.
Example - 1
The following code snippet uses 0.0.0.0 in a Puppet script.
listenaddr => "0.0.0.0",port => "9100",code_tag => "SIGNING_SERVER",
"nightly-key-signing-server":}signingserver::instance {The Puppet code snippet is used to provision a signing server that will use 0.0.0.0 to accept traffic. However, as 0.0.0.0 is unrestricted, malicious users may use this IP address to launch frequent requests and cause denial of service attacks.
listenaddr => "127.0.0.1",port => "9100",code_tag => "SIGNING_SERVER",
"nightly-key-signing-server":}signingserver::instance {Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.