Weaknesses of type CWE-180

33 results

Validação antes da canonicalização

A fraqueza ocorre quando o código valida entrada usando uma forma não-canônica, mas processa a mesma entrada em forma canônica depois. Um atacante pode contornar a validação usando representações alternativas (como `../` vs `..\ ` ou encoded characters) que passam na checagem inicial mas se transformam em payloads perigosos após normalização.

Example

Um WAF valida uma URL procurando por `../../../etc/passwd`, a bloqueia, mas o servidor depois decodifica `..%2f..%2f..%2fetc%2fpasswd` (que passou na validação) e executa o path traversal. Ou uma checagem rejeita `<script>` mas aceita `<ScRiPt>`, que é canonicalizado para minúsculas no parser HTML e executa.

How to mitigate

Canonicalize (normalize) a entrada ANTES de validar, não depois. Aplique decoding, lowercase, remoção de espaços e resolução de paths antes de qualquer checagem de segurança. Use whitelist rigorosa de caracteres permitidos após normalização completa.

CVE-2026-72917MEDIUMAnythingLLM: Password recovery accepts one recovery code twice after whitespace normalizationEPSS 0.3%CVE-2026-34786MEDIUMRack: Rack::Static header_rules bypass via URL-encoded pathsEPSS 0.3%CVE-2026-79300LOWSEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can crEPSS 0.3%CVE-2026-42462HIGHFedify has an LD-Signature Bypass via JSON-LD Named-Graph RestructuringEPSS 0.2%CVE-2026-48721HIGHWarp: Env-var prefixes can lead to denylisted command autoexecutionEPSS 0.2%CVE-2026-69245MEDIUMGuzzle: Noncanonical cookie domain keeps subdomain scopeEPSS 0.2%CVE-2026-82736LOWAsh.Type.CiString validates length and match constraints before case folding, allowing constraint bypassEPSS 0.2%CVE-2026-45022HIGHgo-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream GitEPSS 0.2%CVE-2025-33194MEDIUMNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper processing of input data. A successEPSS 0.1%CVE-2024-28607LOWThe ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as gloEPSS 0.1%CVE-2026-100230MEDIUMInput Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versEPSS —CVE-2026-95811MEDIUMLemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict itEPSS —CVE-2026-97764LOWdjango-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attackerEPSS —