Compound Element ID: 291 (Compound Element Variant: Composite)
Status: Incomplete
Description
Description Summary
The use of IP addresses as authentication is flawed and can easily be spoofed by malicious users.
Extended Description
As IP addresses can be easily spoofed, they do not constitute a valid authentication mechanism. Alternate methods should be used if significant authentication is necessary.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Non-Repudiation
Technical Impact: Hide activities; Gain privileges / assume
identity
Malicious users can fake authentication information, impersonating any
IP address.
This example checks if a request is from a trusted address before
responding to a request, but the code only verifies the address as
stored in the request packet. An attacker can spoof this address, thus
impersonating a trusted client
Potential Mitigations
Phase: Architecture and Design
Use other means of identity verification that cannot be simply
spoofed. Possibilities include a username/password or
certificate.
Weakness Ordinalities
Ordinality
Description
Resultant
(where
the weakness is typically related to the presence of some other
weaknesses)
Gain privileges by modifying assumed-immutable
code addresses that are accessed by a driver.
Potential Mitigations
Phases: Architecture and Design; Operation; Implementation
Implement proper protection for immutable data (e.g. environment
variable, hidden form fields, etc.)
Other Notes
Factors: MAID issues can be primary to many other weaknesses, and they are
a major factor in languages such as PHP.
This happens when a particular input is critical enough to the functioning
of the application that it should not be modifiable at all, but it is. A
common programmer assumption is that certain variables are immutable;
especially consider hidden form fields in web applications. So there are
many examples where the MUTABILITY property is a major factor in a
vulnerability.
Common data types that are attacked are environment variables, web
application parameters, and HTTP headers.
The software has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
Web product uses the IP address in the
X-Forwarded-For HTTP header instead of a server variable that uses the
connecting IP address, allowing filter
bypass.
Description
