CME-205
Service Binding to Localhost
Description
Configures services to listen only on 127.0.0.1/::1, eliminating remote network attack vector entirely. Remote access must go through a reverse proxy or tunnel.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Vector (AV) | N → L | Service not reachable from network; requires local access |
CWE Relationships
Verification
Check service listen address is localhost only
$ ss -tlnp | grep ':8080'
# Expected: 127.0.0.1:8080
# Expected: 127.0.0.1:8080
Platform: linux