Audit: Binding to all interfaces detected with hardcoded values BAN-B104
Possible binding to all interfaces.
50 "ignoreerrors": True,
51 "quiet": True,
52 "no_warnings": True,
53 "source_address": "0.0.0.0", 54 "forceip": "4", 55 "skip_download": True, 56 "extract_flat": True, 57 "default_search": "auto", 58 } 59)
60
61Possible binding to all interfaces.
37 "ignoreerrors": True,
38 "quiet": True,
39 "no_warnings": True,
40 "source_address": "0.0.0.0",41 "forceip": "4",42 "skip_download": True,43 "extract_flat": True,44 "default_search": "auto",45 }46)
47
48yt = pytube.YouTube("https://www.youtube.com/watch?v=hTqFFYX93yY")
Description
Binding to all network interfaces can potentially open up a service to traffic on unintended interfaces, that may not be properly documented or secured. This can be prevented by changing the code so it explicitly only allows access from localhost.
When binding to 0.0.0.0, you accept incoming connections from anywhere. During development, an application may have security vulnerabilities making it susceptible to SQL injections and other attacks. Therefore when the application is not ready for production, accepting connections from anywhere can be dangerous.
It is recommended to use 127.0.0.1 or local host during development phase. This prevents others from targeting your application and executing SQL injections against your project.
Bad practice
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0, 31137)) # Binding to all interfaces
Recommended
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('127.0.0.1', 31137)) # Binding to local host
```
References:
- OWASP Top 10 2021 Category A05 - Security Misconfiguration