Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (3.2)  

CWE-941: Incorrectly Specified Destination in a Communication Channel

Weakness ID: 941
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The software creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
+ Extended Description

Attackers at the destination may be able to spoof trusted servers to steal data or cause a denial of service.

There are at least two distinct weaknesses that can cause the software to communicate with an unintended destination:

  • If the software allows an attacker to control which destination is specified, then the attacker can cause it to connect to an untrusted or malicious destination. For example, because UDP is a connectionless protocol, UDP packets can be spoofed by specifying a false source address in the packet; when the server receives the packet and sends a reply, it will specify a destination by using the source of the incoming packet - i.e., the false source. The server can then be tricked into sending traffic to the wrong host, which is effective for hiding the real source of an attack and for conducting a distributed denial of service (DDoS). As another example, server-side request forgery (SSRF) and XML External Entity (XXE) can be used to trick a server into making outgoing requests to hosts that cannot be directly accessed by the attacker due to firewall restrictions.
  • If the software incorrectly specifies the destination, then an attacker who can control this destination might be able to spoof trusted servers. While the most common occurrence is likely due to misconfiguration by an administrator, this can be resultant from other weaknesses. For example, the software might incorrectly parse an e-mail or IP address and send sensitive data to an unintended destination. As another example, an Android application may use a "sticky broadcast" to communicate with a receiver for a particular application, but since sticky broadcasts can be processed by *any* receiver, this can allow a malicious application to access restricted data that was only intended for a different application.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
ChildOfClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness.923Improper Restriction of Communication Channel to Intended Endpoints
CanPrecedeBaseBase - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness.406Insufficient Control of Network Message Volume (Network Amplification)
+ Relevant to the view "Architectural Concepts" (CWE-1008)
MemberOfCategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.1014Identify Actors
+ Relevant to the view "Development Concepts" (CWE-699)
ChildOfClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness.923Improper Restriction of Communication Channel to Intended Endpoints
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

Architecture and Design
ImplementationREALIZATION: This weakness is caused during implementation of an architectural security tactic.
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.


Class: Language-Independent (Undetermined Prevalence)


Mobile (Undetermined Prevalence)

+ Demonstrative Examples

Example 1

This code listens on a port for DNS requests and sends the result to the requesting address.

(bad code)
Example Language: Python 
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind( (UDP_IP,UDP_PORT) )
while true:
data = sock.recvfrom(1024)
if not data:

(requestIP, nameToResolve) = parseUDPpacket(data)
record = resolveName(nameToResolve)

This code sends a DNS record to a requesting IP address. UDP allows the source IP address to be easily changed ('spoofed'), thus allowing an attacker to redirect responses to a target, which may be then be overwhelmed by the network traffic.

+ Observed Examples
composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses.
Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses.
DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker.
+ Notes


This entry will be made more comprehensive in later CWE versions.
+ References
[REF-941] US-CERT. "UDP-based Amplification Attacks". 2014-01-17. <>.
+ Content History
Submission DateSubmitterOrganization
2014-02-13CWE Content TeamMITRE
Modification DateModifierOrganization
2017-11-08CWE Content TeamMITRE
updated Modes_of_Introduction, References, Relationships

More information is available — Please select a different filter.
Page Last Updated: December 27, 2018