CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

Description:
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Extended Description:
Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint. 
             While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based, Web Server
Parent weaknesses: CWE-284

Consequences:
  - Integrity: Gain Privileges or Assume Identity

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:
Flash crossdomain.xml :
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"> <allow-access-from domain="*.example.com"/> <allow-access-from domain="*"/> </cross-domain-policy>
<?xml version="1.0" encoding="utf-8"?> <access-policy> <cross-domain-access> <policy> <allow-from http-request-headers="SOAPAction"> <domain uri="*"/> </allow-from> <grant-to> <resource path="/" include-subpaths="true"/> </grant-to> </policy> </cross-domain-access> </access-policy>

This Android application will remove a user account when it receives an intent to do so:
This application does not check the origin of the intent, thus allowing any malicious application to remove a user. Always check the origin of an intent, or create an allowlist of trusted applications using the manifest.xml file.
IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); 
                      public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }

Real-world examples:
  - CVE-2022-30319: S-bus functionality in a home automation product performs access control using an IP allowlist, which can be bypassed by a forged IP address.
  - CVE-2022-22547: A troubleshooting tool exposes a web server on a random port between 9000-65535 that could be used for information gathering
  - CVE-2022-4390: A WAN interface on a router has firewall restrictions enabled for IPv4, but it does not for IPv6, which is enabled by default
  - CVE-2012-2292: Product has a Silverlight cross-domain policy that does not restrict access to another application, which allows remote attackers to bypass the Same Origin Policy.
  - CVE-2012-5810: Mobile banking application does not verify hostname, leading to financial loss.