VNX-1327: Binding to an Unrestricted IP Address

Reports servers bound to a hard-coded wildcard address (0.0.0.0, ::, [::], Python's empty host) in Python, Node.js and Go: socket bind, app.run/uvicorn host=, .listen(port, '0.0.0.0'), net.Listen("tcp", "0.0.0.0:port"), http.Server{Addr:}, directly or through a constant. Loopback, configured addresses and Go's ":port" form are not reported.

Field	Value
Rule ID	`VNX-1327`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Go, JavaScript / TypeScript, Python
CWE	CWE-1327
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`binding-to-unrestricted-ip-addr` `network` `exposure` `cwe-1327`
Source	`internal/sast/rules/vnx-1327.rego`

Overview

VNX-1327 maps to CWE-1327: Binding to an Unrestricted IP Address. A socket bound to 0.0.0.0 or :: accepts connections on every network interface. An admin endpoint, debug server or internal API written that way is reachable from any network the host is attached to.

Why This Matters

Services that were only meant to be reached locally (a Flask dev server with debug=True, a pprof listener, a metrics port) become network-facing when they bind to all interfaces. Combined with missing authentication, that is a direct remote attack surface.

What Gets Flagged

app.run(host='0.0.0.0', port=5000, debug=True)        # FLAGGED
s.bind(("0.0.0.0", port))                              # FLAGGED
HOST = "0.0.0.0"
web.run_app(app, host=HOST, port=PORT)                 # FLAGGED

app.listen(3000, '0.0.0.0', () => console.log('up'))   // FLAGGED
await fastify.listen({ port: PORT, host: '0.0.0.0' })  // FLAGGED

ln, err := net.Listen("tcp", "0.0.0.0:9000")           // FLAGGED
srv := &http.Server{Addr: "0.0.0.0:8443"}              // FLAGGED
addr := "0.0.0.0:6060"
http.ListenAndServe(addr, mux)                         // FLAGGED

What Is Not Flagged

Loopback or named hosts (127.0.0.1, localhost).
An address read from configuration or the environment, even with a wildcard default (os.environ.get("HOST", "0.0.0.0")).
Go’s ":8080" form. It binds every interface too, but it is the language default used by nearly every server, and reporting it would bury the deliberate wildcards.
CIDR strings (0.0.0.0/0), IP comparisons, comments, unrelated strings and test files.

Remediation

Bind to 127.0.0.1 (or a specific interface) for anything that should not be network-facing.
Take the bind address from configuration so each deployment chooses it, and default to loopback.
Where a container must listen on all interfaces, restrict exposure with the network policy, security group or port mapping instead.

References

CWE-1327: Binding to an Unrestricted IP Address

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1327
// nosec vnx-1327

Or record an ignore rule: vulnetix ignore add --rule vnx-1327 --reason "...". See Suppressing findings.