CWE-1327: Binding to an Unrestricted IP Address
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
How it's found
Binding to an Unrestricted IP Address is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
When a server binds to the address 0.0.0.0, it allows connections from every IP address on the local machine, effectively exposing the server to every possible network. This might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.
Vulnerable vs. safe
listenaddr => "0.0.0.0",port => "9100",code_tag => "SIGNING_SERVER",
"nightly-key-signing-server":}signingserver::instance {listenaddr => "127.0.0.1",port => "9100",code_tag => "SIGNING_SERVER",
"nightly-key-signing-server":}signingserver::instance {Consequences
- DoS: Amplification
Mitigations
- System Configuration: Assign IP addresses that are not 0.0.0.0.
- System Configuration: Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-1327?
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
How do you find Binding to an Unrestricted IP Address?
Binding to an Unrestricted IP Address is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1327?
DoS: Amplification
Does TurboPentest test for Binding to an Unrestricted IP Address?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest