VariantDraft
CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
Category: other
Description
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
Common consequences· 1
- Access Control — Gain Privileges or Assume Identity, Bypass Protection MechanismMalicious users can fake authentication information by providing false DNS information.
Potential mitigations· 2
- [Architecture and Design]Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate.
- [Implementation]Perform proper forward and reverse DNS lookups to detect DNS spoofing.
Related CAPEC attack patterns· 4
References
Exploits (incoming)4
| Type | Target | Confidence | Tier |
|---|---|---|---|
| AttackPattern | Pharmingcapec-89 | 100% | live |
| AttackPattern | DNS Rebindingcapec-275 | 100% | live |
| AttackPattern | User-Controlled Filenamecapec-73 | 100% | live |
| AttackPattern | DNS Cache Poisoningcapec-142 | 100% | live |
(incoming)3
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Vulnerability | CVE-2025-8036cve-2025-8036 | 0% | live |
| Vulnerability | CVE-2026-1490cve-2026-1490 | 0% | live |
| Vulnerability | CVE-2026-42559cve-2026-42559 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.