Hardcoded IP Address Vulnerability
What does this mean ?
Hardcoding IP addresses is risky in terms of security. Because of its scalability and redundancy requirements, today's services have an ever-changing architecture. It is a common misconception that a service will always have the same IP address. When it does change, the hardcoded IP address must be updated as well. This will affect product development, delivery, and deployment.
What can happen ?
Instead of having an operation team edit a configuration file, the developers will have to execute a quick repair every time this happens. It requires the same address to be used in all environments (dev, sys, QA, prod). Finally, it has an impact on application security. Attackers may be able to decompile the code and uncover a potentially sensitive address as a result. They can use this address to launch a Denial of Service attack or to spoof the IP address. Such an attack is always conceivable, but with a hardcoded IP address, the patch will be significantly slower, increasing the risk's impact.
Recommendation
Make the IP address changeable rather than hard-coded in the source code.
Sample Code
Vulnerable :
var ip = "192.168.12.42";
var address = IPAddress.Parse(ip);
Non Vulnerable :
var ip = ConfigurationManager.AppSettings["myapplication.ip"];
var address = IPAddress.Parse(ip);
Vulnerable :
String ip = "192.168.12.42"; // Sensitive
Socket socket = new Socket(ip, 6667);
Non Vulnerable :
String ip = System.getenv("IP_ADDRESS"); // Compliant
Socket socket = new Socket(ip, 6667);
Vulnerable :
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
socket_connect($socket, '8.8.8.8', 23); // Sensitive
Non Vulnerable :
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
socket_connect($socket, IP_ADDRESS, 23); // Compliant
Vulnerable :
ip = "192.168.22.32"; // Vulnerable
const net = require('net');
const client = new net.Socket();
client.connect(80, ip, () => {
// ...
});
Non Vulnerable :
ip = process.env.IP_ADDRESS; // Non Vulnerable
const net = require('net');
const client = new net.Socket();
client.connect(80, ip, () => {
// ...
});