CWE-647 - Use of Non-Canonical URL Paths for Authorization Decisions
CWE-647 High
- Abstraction:
- Variant
- Structure:
- Simple
- Status:
- Incomplete
- Weakness Name
Use of Non-Canonical URL Paths for Authorization Decisions
- Description
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
If an application defines policy namespaces and makes authorization decisions based on the URL, but it does not require or convert to a canonical URL before making the authorization decision, then it opens the application to attack. For example, if the application only wants to allow access to http://www.example.com/mypage, then the attacker might be able to bypass this restriction using equivalent URLs such as: Therefore it is important to specify access control policy that is based on the path information in some canonical form with all alternate encodings rejected (which can be accomplished by a default deny rule).
- Common Consequences
Scope: Access Control
Impact: Bypass Protection Mechanism
Notes: An attacker may be able to bypass the authorization mechanism to gain access to the otherwise-protected URL.
Scope: Confidentiality
Impact: Read Files or Directories
Notes: If a non-canonical URL is used, the server may choose to return the contents of the file, instead of pre-processing the file (e.g. as a program).
- Related Weaknesses
- Release Date:
- 2008-01-30
- Latest Modification Date:
- 2023-06-29
Free security scan for your website