Software Engineering Institute

CWE-200: Information Exposure

NAT-PMP is a port-mapping protocol in which a network address translation (NAT) device, typically a router, is petitioned by a trusted local network host to forward traffic between the external network and the petitioning host. As specified in RFC 6886, "The NAT gateway MUST NOT accept mapping requests destined to the NAT gateway's external IP address or received on its external network interface." Additionally, mapping requests "must" be mapped to the source address of the internal requesting host. When a NAT-PMP device fails to enforce these restrictions and is unsafely configured, it may accept malicious port mapping requests or disclose information about itself. Rapid7's report describes the scope of the problem and the vulnerabilities that may emerge from incorrect configurations and implementations NAT-PMP:

Vulnerability Summary

During our research, we identified approximately 1.2 million devices on the public Internet that responded to our external NAT-PMP probes.  Their responses represent two types of vulnerabilities; malicious port mapping manipulation and information disclosure about the NAT-PMP device.  These can be broken down into 5 specific issues, outlined below:

• Interception of Internal NAT Traffic: ~30,000 (2.5% of responding devices)
• Interception of External Traffic: ~1.03m (86% of responding devices)
• Access to Internal NAT Client Services: ~1.06m (88% of responding devices)
• DoS Against Host Services: ~1.06m (88% of responding devices)
• Information Disclosure about the NAT-PMP device: ~1.2m (100% of responding devices)

A remote, unauthenticated attacker may be able to gather information about a NAT device, manipulate its port mapping, intercept its private and public traffic, access its private client services, and block its host services.

Configure NAT-PMP Securely

Developers and administrators implementing NAT-PMP should exercise care to ensure that devices are configured securely, specifically that

1. the LAN and WAN interfaces are correctly assigned,
2. NAT-PMP requests are only accepted on internal interfaces, and
3. port mappings are only opened for the requesting internal IP address.

Restrict Access

Deploy firewall rules to block untrusted hosts from being able to access port 5351/udp.

Disable NAT-PMP

Consider disabling NAT-PMP on the device if it is not absolutely necessary.