This is an issue when a web server uses host="0.0.0.0", which binds the application to all available network interfaces on the host
machine.
When you start a Web server, you need to specify which network interface it should listen on. A network interface is a connection point between your computer and a network.
The special IP address 0.0.0.0 tells the application to bind to all network interfaces on the machine. This means the
application becomes accessible from:
This broad exposure violates the principle of least privilege, which states that a system should only have access to the resources it needs to function. By binding to all interfaces, you’re making your application accessible from networks where it shouldn’t be reachable.
In development environments, this is particularly risky because:
Even in production environments, binding to 0.0.0.0 should be a deliberate choice made with proper security controls in place, such
as:
When these controls are absent, binding to all interfaces creates an unnecessarily large attack surface.
Binding to all network interfaces can lead to several security risks:
The severity depends on the environment and what security controls are in place, but the risk is highest in development environments where security measures are typically minimal.
For development, bind to localhost only. For production, use a proper WSGI server instead of app.run().
from flask import Flask
app = Flask(__name__)
@app.route('/')
def hello():
return 'Hello World!'
if __name__ == '__main__':
app.run(host='0.0.0.0', debug=True) # Noncompliant
from flask import Flask
app = Flask(__name__)
@app.route('/')
def hello():
return 'Hello World!'
if __name__ == '__main__':
app.run(host='0.0.0.0', debug=False)
import os
from flask import Flask
app = Flask(__name__)
if __name__ == '__main__':
app.run(host='0.0.0.0', port=5000, debug=True) # Noncompliant
import os
from flask import Flask
app = Flask(__name__)
if __name__ == '__main__':
app.run(host='127.0.0.1', port=5000, debug=True)
For development and local testing, bind to localhost (127.0.0.1 or localhost) instead of all interfaces. This ensures the
application is only accessible from your local machine.
import uvicorn
from fastapi import FastAPI
app = FastAPI()
if __name__ == "__main__":
uvicorn.run(app, host="0.0.0.0", port=8000) # Noncompliant
import uvicorn
from fastapi import FastAPI
app = FastAPI()
if __name__ == "__main__":
uvicorn.run(app, host="127.0.0.1", port=8000)