CME-205

Service Binding to Localhost

Isolate Network Unquantified evidence Preventive

Description

Configures services to listen only on 127.0.0.1/::1, eliminating remote network attack vector entirely. Remote access must go through a reverse proxy or tunnel.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Vector (AV)	N → L	Service not reachable from network; requires local access

CWE Relationships

CWE-284 CWE-668

Verification

Check service listen address is localhost only

$ ss -tlnp | grep ':8080'
# Expected: 127.0.0.1:8080

Platform: linux

Remediation

linux Configure service listen address to localhost only


sed -i 's/^\(\s*bind_address\s*=\s*\)0\.0\.0\.0/\1127.0.0.1/' <config_file>
systemctl restart <service>