The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Primary

Architecture and Design

Implementation

Access Control
Bypass Protection Mechanism
Gain Privileges or Assume Identity
An attacker could utilize the untrusted data source to bypass protection mechanisms and gain access to sensitive data.

This code attempts to limit the access of a page to certain IP Addresses. It checks the 'HTTP_X_FORWARDED_FOR' header in case an authorized user is sending the request through a proxy.

$requestingIP = '0.0.0.0';if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {$requestingIP = $_SERVER['HTTP_X_FORWARDED_FOR'];
else{$requestingIP = $_SERVER['REMOTE_ADDR'];}
if(in_array($requestingIP,$ipAllowlist)){generatePage();return;}else{echo "You are not authorized to view this page";return;}

The 'HTTP_X_FORWARDED_FOR' header can be user controlled and so should never be trusted. An attacker can falsify the header to gain access to the page.
This fixed code only trusts the 'REMOTE_ADDR' header and so avoids the issue:

$requestingIP = '0.0.0.0';if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {echo "This application cannot be accessed through a proxy.";return;
else{$requestingIP = $_SERVER['REMOTE_ADDR'];}
...

Be aware that 'REMOTE_ADDR' can still be spoofed. This may seem useless because the server will send the response to the fake address and not the attacker, but this may still be enough to conduct an attack. For example, if the generatePage() function in this code is resource intensive, an attacker could flood the server with fake requests using an authorized IP and consume significant resources. This could be a serious DoS attack even though the attacker would never see the page's sensitive content.

CVE-2001-0860
Product uses IP address provided by a client, instead of obtaining it from the packet headers, allowing easier spoofing.
https://www.cve.org/CVERecord?id=CVE-2001-0860

CVE-2004-1950
Web product uses the IP address in the X-Forwarded-For HTTP header instead of a server variable that uses the connecting IP address, allowing filter bypass.
https://www.cve.org/CVERecord?id=CVE-2004-1950

CVE-2001-0908
Product logs IP address specified by the client instead of obtaining it from the packet headers, allowing information hiding.
https://www.cve.org/CVERecord?id=CVE-2001-0908

CVE-2006-1126
PHP application uses IP address from X-Forwarded-For HTTP header, instead of REMOTE_ADDR.
https://www.cve.org/CVERecord?id=CVE-2006-1126

Use of Less Trusted Source

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, Demonstrative_Examples, Observed_Examples, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2013-07-17
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Demonstrative_Examples

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities