|
|
Status: Incomplete Weakness ID: 647 (Weakness Variant)Description Summary If an application defines policy namespaces and makes authorization decisions based on URL containing a particular encoding for the path (e.g. using one way of representing an IP address) without having a default policy to deny access, an alternate (but equivalent) encoding for the path may be used to bypass the authorization checks. Therefore it is important to specify access control policy that is based on the path information in some canonical form with all alternate encodings rejected (which can be accomplished by a default deny rule). Likelihood of Exploit High Common Consequences Privilege Escalation Information Leakage Enabling Factors for Exploitation An application specifies its policy namespaces and access control rules based on the path information. Alternate (but equivalent) encodings exist to represent the same path information that will be understood and accepted by the process consuming the path and granting access to resources. Potential Mitigations Make access control policy based on path information in canonical form. Use very restrictive regular expressions to validate that the path is in the expected form. Reject all alternate path encodings that are not in the expected canonical form. Observed Examples
Relationships
Applicable Platforms Languages All Time of Introduction  Architecture and Design Implementation OperationContent History Modifications CWE Content Team. MITRE. 2008-09-08. (Internal) updated Common_Consequences, Relationships |
|
|
|||
