CWE-941 Incorrectly Specified Destination in a Communication Channel

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

• Access Control, Other: Gain Privileges or Assume Identity, Varies by Context, Bypass Protection Mechanism — An attacker at the destination may be able to spoof trusted servers to steal data or cause a denial of service. The attacker can access any functionality that is inadvertently accessible to the source. • If the product allows an attacker to control/specify the destination, then the attacker can cause it to connect to an untrusted or malicious destination. For example, because UDP is a connectionless protocol, UDP packets can be spoofed by specifying a false source address in the packet; when the server receives the packet and sends a reply, it will specify a destination by using the source of the incoming packet - i.e., the false source. The server can then be tricked into sending traffic to the wrong host, which is effective for hiding the real source of an attack and for conducting a distributed denial of service (DDoS). As another example, server-side request forgery (SSRF) and XML External Entity (XXE) can be used to trick a server into making outgoing requests to hosts that cannot be directly accessed by the attacker due to firewall restrictions. • If the product incorrectly specifies the destination, then an attacker who can control this destination might be able to spoof trusted components or servers.

• CVE-2013-5211: composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses. • CVE-1999-0513: Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses. • CVE-1999-1379: DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker.