This weakness occurs when an application uses easily-forged characteristics—such as IP addresses, hostnames, or HTTP headers—as the primary basis for…
This weakness occurs when an application uses easily-forged characteristics—such as IP addresses, hostnames, or HTTP headers—as the primary basis for authentication or authorization decisions. An attacker can spoof these characteristics to impersonate a trusted user or system, bypassing security controls entirely. This is a critical flaw because it treats network-level properties as cryptographic proof of identity, which they are not.
Authentication should rely on secrets that only the legitimate user possesses: passwords, cryptographic keys, or multi-factor tokens. Spoofable characteristics like IP addresses, DNS hostnames, or the X-Forwarded-For header are visible and controllable by an attacker on the network path. When an application trusts these alone to grant access—for example, "allow all requests from 192.168.1.0/24" or "trust any request with a matching hostname"—an attacker can forge those characteristics by modifying network packets, compromising routing, or simply crafting HTTP headers. The application has no way to verify that the request truly came from the claimed source.
An attacker exploiting this weakness can gain unauthorized access to sensitive functions, administrative panels, or user accounts without knowing any passwords. They may read or modify data, escalate privileges, or perform actions on behalf of legitimate users. In internal network scenarios, this can lead to lateral movement and full system compromise. The impact is severe because the attacker needs no credentials and the vulnerability is often invisible to logs that only record the spoofed IP.
from flask import Flask, request
app = Flask(__name__)
@app.route('/admin')
def admin_panel():
# Vulnerable: trusting IP address alone
if request.remote_addr == '192.168.1.100':
return "Admin panel: [sensitive data]"
else:
return "Access denied", 403Why it's vulnerable:
The remote_addr can be spoofed via proxy headers or network manipulation. An attacker can send a request with a forged X-Forwarded-For header or modify their network stack to appear to come from the trusted IP.
from flask import Flask, request, session
from functools import wraps
app = Flask(__name__)
app.secret_key = 'your-secret-key'
def require_login(f):
@wraps(f)
def decorated_function(*args, **kwargs):
if 'user_id' not in session:
return "Unauthorized", 401
return f(*args, **kwargs)
return decorated_function
@app.route('/admin')
@require_login
def admin_panel():
return "Admin panel: [sensitive data]"<?php
// Vulnerable: trusting IP address alone
$trusted_ip = '192.168.1.100';
if ($_SERVER['REMOTE_ADDR'] === $trusted_ip) {
echo "Admin panel: [sensitive data]";
} else {
http_response_code(403);
echo "Access denied";
}
?>Why it's vulnerable:
$_SERVER['REMOTE_ADDR'] can be spoofed via proxy headers or network-level attacks. An attacker can also manipulate X-Forwarded-For if the server trusts it without validation.
<?php
session_start();
// Require authenticated session
if (!isset($_SESSION['user_id']) || !isset($_SESSION['user_role']) || $_SESSION['user_role'] !== 'admin') {
http_response_code(401);
echo "Unauthorized";
exit;
}
echo "Admin panel: [sensitive data]";
?>X-Forwarded-For, X-Real-IP, or similar headers; validate them against your network topology and only use them for logging, not access control.
Review your authentication logs for access patterns that don't match expected user behavior—for example, admin actions from unusual IP addresses at odd times, or multiple user accounts accessing the same resource simultaneously from different locations. Check your application code for any authentication checks that rely solely on REMOTE_ADDR, hostname matching, or unvalidated HTTP headers without a corresponding session or token validation. If you find such patterns, they should be treated as high-priority security issues.
