CWE-647

Use of Non-Canonical URL Paths for Authorization Decisions

High

Description

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

Potential Impact

How to Fix

Architecture and Design

Make access control policy based on path information in canonical form. Use very restrictive regular expressions to validate that the path is in the expected form.

Architecture and Design

Reject all alternate path encodings that are not in the expected canonical form.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-647 vulnerabilities in your codebase.

Get Security Assessment