CWE-647Use of Non-Canonical URL Paths for Authorization Decisions

Description

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

[object Object]

Common consequences

• Access Control→Bypass Protection Mechanism
  An attacker may be able to bypass the authorization mechanism to gain access to the otherwise-protected URL.
• Confidentiality→Read Files or Directories
  If a non-canonical URL is used, the server may choose to return the contents of the file, instead of pre-processing the file (e.g. as a program).

Potential mitigations

• Architecture and Design
  Make access control policy based on path information in canonical form. Use very restrictive regular expressions to validate that the path is in the expected form.
• Architecture and Design
  Reject all alternate path encodings that are not in the expected canonical form.

Related CWEs

Recent CVEs classified under this CWE