Common Weakness Enumeration

目的地的攻击者可能能够欺骗受信任的服务器窃取数据或导致服务拒绝。

There are at least two distinct weaknesses that can cause the product to communicate with an unintended destination:

• If the product allows an attacker to control which destination is specified, then the attacker can cause it to connect to an untrusted or malicious destination. For example, because UDP is a connectionless protocol, UDP packets can be spoofed by specifying a false source address in the packet; when the server receives the packet and sends a reply, it will specify a destination by using the source of the incoming packet - i.e., the false source. The server can then be tricked into sending traffic to the wrong host, which is effective for hiding the real source of an attack and for conducting a distributed denial of service (DDoS). As another example, server-side request forgery (SSRF) and XML External Entity (XXE) can be used to trick a server into making outgoing requests to hosts that cannot be directly accessed by the attacker due to firewall restrictions.
• 如果产品错误地指定了目的地，那么可以控制此目的地的攻击者可能会欺骗受信任的服务器。尽管最常见的发生可能是由于管理员的配置错误，但这可能是其他弱点引起的。例如，该产品可能会错误地解析电子邮件或IP地址，并将敏感数据发送到意外的目的地。作为另一个例子，Android应用程序可以使用“粘性广播”与接收器进行特定应用程序通信，但是由于 * Any *接收器可以处理粘性广播，因此可以允许恶意应用程序访问限制性数据，仅限打算用于不同的应用程序。

This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

Technologies

Example 1

该代码在DNS请求的端口上听，并将结果发送到请求地址。

此代码将DNS记录发送到请求的IP地址。UDP允许轻松更改源IP地址（“欺骗”），从而使攻击者可以将响应重定向到目标，然后可能会被网络流量淹没。