Use of Non-Canonical URL Paths for Authorization Decisions
CWE-647
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical.
If an application defines policy namespaces and makes authorization decisions based on the URL, but it does not require or convert to a canonical URL before making the authorization decision, then it opens the application to attack. For example, if the application only wants to allow access to http://www.example.com/mypage, then the attacker might be able to bypass this restriction using equivalent URLs such as: http://WWW.EXAMPLE.COM/mypage http://www.example.com/%6Dypage (alternate encoding) http://192.168.1.1/mypage (IP address) http://www.example.com/mypage/ (trailing /) http://www.example.com:80/mypage
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Make access control policy based on path information in canonical form, with all alternate encodings rejected (which can be accomplished by a default deny rule). Consider very restrictive regular expressions to validate that the path is in the expected form. Reject all alternate path encodings that are not in the expected canonical form.
Latest Use of Non-Canonical URL Paths for Authorization Decisions vulnerabilities
- 8.8 High severity
Splunk SOAR: Use of Non-Canonical URL Paths for Authorization Decisions
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T
- 8.9 High severity
Eclipse Arrowhead: Use of Non-Canonical URL Paths for Authorization Decisions
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL()
- 8.1 High severity
filebrowser: Use of Non-Canonical URL Paths for Authorization Decisions
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and Cr
- 8.2 High severity
astro: Use of Non-Canonical URL Paths for Authorization Decisions
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation
- 7.3 High severity
symfony: Use of Non-Canonical URL Paths for Authorization Decisions
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and
- 9.8 Critical severity
Hitachi Vantara Pentaho BA Server Authorization Bypass Exploited
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.