Fallos del tipo CWE-180

32 resultados

Validação antes da canonicalização

A aplicação valida dados antes de normalizá-los, permitindo que entradas malformadas ou ofuscadas passem pela verificação. Um atacante contorna filtros usando representações alternativas do mesmo dado (ex: URLs codificadas, caminhos com ../, caracteres Unicode) que a validação não reconhece, mas o sistema normaliza depois e processa como legítimo.

Ejemplo

Um WAF bloqueia acesso a '/admin' na validação, mas o atacante envia '/%2e%2e/admin' (../ codificado em URL). A validação não reconhece, deixa passar, e após decodificação a aplicação interpreta como caminho válido para admin.

Cómo mitigar

Canonicalize (normalize) os dados ANTES de qualquer validação de segurança. Aplique todas as transformações possíveis — decodificação URL, remoção de espaços, normalização Unicode, resolução de caminhos — e só depois valide contra listas de controle ou regras de segurança.

CVE-2022-26136CRITICALA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third pEPSS 5.4%CVE-2022-26137HIGHA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked wEPSS 2.3%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 1.5%CVE-2025-43716MEDIUMA directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /cliEPSS 1.2%CVE-2026-27590HIGHCaddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transportEPSS 0.9%CVE-2026-73420CRITICALNextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassEPSS 0.7%CVE-2026-82481HIGHThe cohttp package before 6.3.0 for OCaml allows directory traversal.EPSS 0.7%CVE-2026-73416MEDIUMjupyterlab: PyPI extension blocklist package-name canonicalization bypassEPSS 0.7%CVE-2026-15704CRITICALCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go ComponentsEPSS 0.7%CVE-2026-24895HIGHFrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesEPSS 0.6%CVE-2026-49984HIGHKestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)EPSS 0.6%CVE-2025-29787HIGHzip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File WriteEPSS 0.6%CVE-2026-90813MEDIUMcosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalizeEPSS 0.6%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%CVE-2026-62999HIGHCopier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)EPSS 0.4%CVE-2026-39409MEDIUMHono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesEPSS 0.4%CVE-2026-76203MEDIUMCSS sanitizer bypass in Pentestify report themes allows forced outbound requestsEPSS 0.4%CVE-2026-69246HIGHGuzzle: Noncanonical host can bypass host-based checksEPSS 0.4%CVE-2026-7120MEDIUM@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL PathsEPSS 0.4%CVE-2026-34475MEDIUMVarnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / EPSS 0.4%