cve.bz

CAPEC-4

Using Alternative IP Address Encodings

High severityMedium likelihoodDetailed pattern

This attack relies on the adversary using unexpected formats for representing IP addresses. Networked applications may expect network location information in a specific format, such as fully qualified domains names (FQDNs), URL, IP address, or IP Address ranges. If the location information is not validated against a variety of different possible encodings and formats, the adversary can use an alternate format to bypass application access control.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-4: Using Alternative IP Address Encodings: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/4.html and https://cve.bz/cve/capec/4?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Survey the application for IP addresses as user input] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application where IP addresses are used.

      4 techniques
      • Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
      • Use a proxy tool to record all user input entry points visited during a manual traversal of the web application.
      • Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
      • Manually inspect the application to find entry points.

  2. Experiment

    They probe what they found.

    1. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and attempts alternate IP address encodings, observing application behavior. The adversary will also attempt to access the application through an alternate IP address encoding to see if access control changes

      3 techniques
      • Instead of using a URL, use the IP address that the URL resolves to
      • Specify a port directly to a URL input
      • Omit or add "http://" or "https://" to a URL to see if the application behaves differently

  3. Exploit

    They carry out the attack.

    1. [Bypass access control] Using an alternate IP address encoding, the adversary will either access the application or give the alternate encoding as input, bypassing access control restrictions.

Prerequisites

  • The target software must fail to anticipate all of the possible valid encodings of an IP/web address.

  • The adversary must have the ability to communicate with the server.

Skills required

  • Low skill

    The adversary has only to try IP address format combinations.

Resources required

  • The adversary needs to have knowledge of an alternative IP address encoding that bypasses the access control policy of an application. Alternatively, the adversary can simply try to brute-force various encoding possibilities.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Gain PrivilegesConfidentiality, Access Control, Authorization

Mitigations

  • Design: Default deny access control policies

  • Design: Input validation routines should check and enforce both input data types and content against a positive specification. In regards to IP addresses, this should include the authorized manner for the application to represent IP addresses and not accept user specified IP addresses and IP address formats (such as ranges)

  • Implementation: Perform input validation for all remote content.

Weaknesses it exploits

  • CWE-173 Improper Handling of Alternate Encoding
  • CWE-291 Reliance on IP Address for Authentication

Recent CVEs with these weaknesses

  1. 8.8CVE-2026-107154

    A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

  2. 6.9CVE-2026-103276

    Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensi…

  3. 2.1CVE-2026-81638

    Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-3…

  4. 3.3CVE-2026-86485

    In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

  5. 7.4CVE-2026-19611

    A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an …

  6. 8.7CVE-2026-10050

    In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be I…

  7. 7.4CVE-2026-3690

    OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific fla…

  8. 8.9CVE-2026-4252

    A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate th…

The newest records naming one of them. Each weakness's page lists them all.

Part of

Examples

An adversary identifies an application server that applies a security policy based on the domain and applicat…

An adversary identifies an application server that applies a security policy based on the domain and application name. For example, the access control policy covers authentication and authorization for anyone accessing http://example.domain:8080/application. However, by using the IP address of the host instead (http://192.168.0.1:8080/application), the application authentication and authorization controls may be bypassed. The adversary relies on the victim applying policy to the namespace abstraction and not having a default deny policy in place to manage exceptions.

MITRE's words, unchanged: CAPEC-4 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.