CWE-1327: Binding to an Unrestricted IP Address
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
How it's found
Binding to an Unrestricted IP Address is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
When a server binds to the address 0.0.0.0, it allows connections from every IP address on the local machine, effectively exposing the server to every possible network. This might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.
Vulnerable vs. safe
listenaddr => "0.0.0.0",port => "9100",code_tag => "SIGNING_SERVER",
"nightly-key-signing-server":}signingserver::instance {listenaddr => "127.0.0.1",port => "9100",code_tag => "SIGNING_SERVER",
"nightly-key-signing-server":}signingserver::instance {Consequences
- DoS: Amplification
Mitigations
- System Configuration: Assign IP addresses that are not 0.0.0.0.
- System Configuration: Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-1327?
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
How do you find Binding to an Unrestricted IP Address?
Binding to an Unrestricted IP Address is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1327?
DoS: Amplification
Does TurboPentest test for Binding to an Unrestricted IP Address?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest