The software has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism; Gain privileges / assume
identity
An attacker could utilize the untrusted data source to bypass
protection mechanisms and gain access to sensitive data.
Demonstrative Examples
Example 1
This code attempts to limit the access of a page to certain IP
Addresses. It checks the 'HTTP_X_FORWARDED_FOR' header in case an authorized
user is sending the request through a proxy.
(Bad Code)
Example
Language: PHP
$requestingIP = '0.0.0.0';
if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {
$requestingIP = $_SERVER['HTTP_X_FORWARDED_FOR'];
else{
$requestingIP = $_SERVER['REMOTE_ADDR'];
}
if(in_array($requestingIP,$ipWhitelist)){
generatePage();
return;
}
else{
echo "You are not authorized to view this page";
return;
}
The 'HTTP_X_FORWARDED_FOR' header can be user controlled and so should
never be trusted. An attacker can falsify the header to gain access to
the page.
This fixed code only trusts the 'REMOTE_ADDR' header and so avoids the
issue:
(Good Code)
Example
Language: PHP
$requestingIP = '0.0.0.0';
if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {
echo "This application cannot be accessed through a
proxy.";
return;
else{
$requestingIP = $_SERVER['REMOTE_ADDR'];
}
...
Be aware that 'REMOTE_ADDR' can still be spoofed. This may seem
useless because the server will send the response to the fake address
and not the attacker, but this may still be enough to conduct an attack.
For example, if the generatePage() function in this code is resource
intensive, an attacker could flood the server with fake requests using
an authorized IP and consume significant resources. This could be a
serious DoS attack even though the attacker would never see the page's
sensitive content.
Web product uses the IP address in the
X-Forwarded-For HTTP header instead of a server variable that uses the
connecting IP address, allowing filter
bypass.
More information is available — Please select a different filter.
Page Last Updated:
May 05, 2017
Use of the Common Weakness Enumeration and the associated references from this website are subject to the
Terms of Use. For more information, please email
cwe@mitre.org.
Description
