# IP-in-IP protocol routes arbitrary traffic by default

IP-in-IP (RFC 2003) accepted from any source by default lets unauthenticated attackers tunnel arbitrary traffic through vulnerable devices, enabling reflective DDoS and ACL bypass.

- Payout: unconfirmed
- Severity: medium
- Program: Internet Bug Bounty
- Credited: yannayl
- Disclosed: 2020-06-02
- CVE: CVE-2020-10136
- Write-up quality: 6/10
- Original: https://kb.cert.org/vuls/id/636397
- Library page: https://bugbountylibrary.com/r/blog%3Akb-cert-org-vuls-id-636397
- Tags: domain:network impact:dos impact:internal-access kind:bounty platform:blog sev:medium tech:linux technique:default-creds vuln:misconfiguration

**Target:** IPv4/IPv6 network stack IP-in-IP decapsulation (protocol number 4)
**Root cause:** Devices accept IP-in-IP encapsulated packets from any source to any destination without explicit configuration, then unwrap the inner packet and forward it via routing tables without inspection.
**Steps:**
1. Craft an outer IPv4 packet with Protocol field = 4 (IP-in-IP) containing an inner IP packet with arbitrary spoofed source/destination.
2. Send to a vulnerable device that has IP-in-IP enabled by default and no source/destination ACL.
3. Device decapsulates and routes the inner packet per its routing tables, forwarding traffic the attacker could not otherwise reach.
4. For reflective DDoS, set inner source to victim so replies flood the victim; for ACL bypass, target internal destinations reachable from the device.
**Exploitation:** Attacker sends IP-in-IP packets to a vulnerable router/device; the device unwraps and forwards the inner packet, reflecting traffic toward a spoofed victim (reflective DDoS) or reaching networks behind the device's ACLs.
**Insight:** Check whether tunneling protocols (IP-in-IP proto 4, GRE, 6in4/4in6) are enabled by default and accept packets from arbitrary sources; a device that decapsulates and routes without source/destination ACLs becomes an open reflector and ACL bypass.