Falhas do tipo CWE-178

86 resultados

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

Ocorre quando o código não trata corretamente diferenças entre maiúsculas e minúsculas em strings, permitindo que um atacante contorne validações, filtros de segurança ou lógica de autorização. Por exemplo, se um firewall bloqueia 'admin.php' mas aceita 'ADMIN.PHP', a proteção é burlada.

Exemplo

Uma aplicação valida extensões bloqueadas comparando contra lista em minúsculas (.exe, .bat), mas o usuário faz upload de 'arquivo.EXE' ou 'arquivo.ExE' que passa pela validação por falta de normalização da entrada antes da comparação.

Como mitigar

Normalize todas as strings para um padrão único (toLowerCase() ou toUpperCase()) antes de qualquer comparação de segurança. Sempre considere o contexto do sistema operacional ou banco de dados — Windows ignora case em caminhos, mas Linux não — e aplique as mesmas regras que o ambiente subjacente usa.

CVE-2024-55634HIGHDrupal core - Moderately critical - Access bypass - SA-CORE-2024-004EPSS 0.4%CVE-2025-61593HIGHCursor CLI Agent: Sensitive File Overwrite BypassEPSS 0.4%CVE-2026-72836CRITICALFileBrowser before 2.63.19 Case Sensitivity Authentication BypassEPSS 0.4%CVE-2026-54528HIGHjupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded DirectoriesEPSS 0.4%CVE-2026-87876LOWCups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)EPSS 0.4%CVE-2026-53721HIGHNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherEPSS 0.4%CVE-2026-42272HIGHHeimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationEPSS 0.4%CVE-2026-78959MEDIUMImproper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engiEPSS 0.4%CVE-2025-59944HIGHCursor IDE: Sensitive File Overwrite Bypass is PossibleEPSS 0.4%CVE-2026-14617LOWNousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivityEPSS 0.4%CVE-2024-38829LOWSpring LDAP sensitive data exposure for case-sensitive comparisonsEPSS 0.4%CVE-2026-27588HIGHCaddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypassEPSS 0.4%CVE-2026-27587HIGHCaddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypassEPSS 0.4%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.4%CVE-2026-15617CRITICALPrincipal/domain lookup without case normalizationEPSS 0.4%CVE-2026-90982MEDIUM@fastify/static vulnerable to route guard bypass via path case-foldingEPSS 0.4%CVE-2026-55170LOWOpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisionsEPSS 0.3%CVE-2026-89012HIGHDolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters ParameterEPSS 0.3%CVE-2026-25889MEDIUMFile Browser has an Authentication Bypass in User Password UpdateEPSS 0.3%CVE-2026-77560HIGHTinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist forEPSS 0.3%