A software system that accepts path input in the form of
internal space ('file(SPACE)name') without appropriate validation can lead to
ambiguous path resolution and allow an attacker to traverse the file system to
unintended locations or access arbitrary files.
"+" characters in query string converted to spaces
before sensitive file/extension (internal space), leading to bypass of
access restrictions to the file.
Potential Mitigations
Phase
Description
see the vulnerability category "Path Equivalence"
Other Notes
This is not necessarily an equivalence issue, but it can also be used to
spoof icons or conduct information hiding via information truncation (see
user interface errors).
This weakness is likely to overlap quoting problems, e.g. the "Program
Files" untrusted search path variants. It also could be an equivalence issue
if filtering removes all extraneous spaces.
Description
