Binding to an unrestricted IP address

Description

Binding to all network interfaces can potentially open up a service to traffic on unintended interfaces, that may not be properly documented or secured. By passing "0.0.0.0" as the address to the `Listen` family of functions, the application will bind to all interfaces.

Examples

Insecure Code

net.Listen("tcp", "0.0.0.0:8080")

Secure Code

addr := os.Getenv("IP_ADDRESS"); listener, err := net.Listen("tcp", addr)

Remediation

Pass the interface IP address through an environment variable, configuration file, or determine the primary interface(s) IP address.

Rule Details

Field	Value
ID	CODE-0794
Category	InsecureConfig
Severity	LOW
CWE	CWE-1327
Confidence	HIGH
Impact	LOW
Likelihood	MEDIUM
Exploitability	MODERATE
Tags	network interface, IP address
OWASP	A6:2017-Security Misconfiguration, A05:2021-Security Misconfiguration

---