CWE-291: Reliance on IP Address for Authentication | Glexia
CWE-291 (Reliance on IP Address for Authentication) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE ATT&CK context.
Glexia's Take · Automated analysis
CWE-291: Reliance on IP Address for Authentication
Reliance on IP Address for Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Access Control Non-Repudiation: Hide Activities Gain Privileges or Assume Identity: Malicious users can fake authentication information, impersonating any IP address.
Developer Pattern
CWE-291 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-291, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-291: Reliance on IP Address for Authentication
The product uses an IP address for authentication.
IP addresses can be easily spoofed. Attackers can forge the source IP address of the packets they send, but response packets will return to the forged IP address. To see the response packets, the attacker has to sniff the traffic between the victim machine and the forged IP address. In order to accomplish the required sniffing, attackers typically attempt to locate themselves on the same subnet as the victim machine. Attackers may be able to circumvent this requirement by using source routing, but source routing is disabled across much of the Internet today. In summary, IP address verification can be a useful part of an authentication scheme, but it should not be the single factor required for authentication.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- Both of these examples check if a request is from a trusted address before responding to the request. The code only verifies the address as stored in the request packet. An attacker can spoof this address, thus impersonating a trusted client.
Remediation
- Architecture and Design: Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.