Falhas do tipo CWE-180

22 resultados

Validação antes da canonicalização

Ocorre quando o código valida dados de entrada antes de normalizá-los para sua forma canônica. O atacante contorna a validação usando representações alternativas (codificações, espaços, barras extras) que passam na verificação, mas depois são processadas de forma diferente. A ordem correta é normalizar primeiro, depois validar.

Exemplo

Um WAF valida a URL '/admin/users' como proibida, mas deixa passar '//admin/users' ou '/admin/../admin/users' porque a barra dupla ou o .. ainda não foram normalizados. O servidor canonicaliza e acessa '/admin/users' mesmo assim, contornando a proteção.

Como mitigar

Sempre canonicalize (normalize, decodifique, expanda) a entrada antes de qualquer validação. Valide apenas a forma final que o sistema realmente processará. Use funções de normalização da linguagem ou framework (ex: realpath() em PHP, normalize() em Java) e nunca confie em validação prévia.

CVE-2022-26136CRITICALA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third pEPSS 5.0%CVE-2022-26137HIGHA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked wEPSS 2.2%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.1%CVE-2025-43716MEDIUMA directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /cliEPSS 1.2%CVE-2026-24895HIGHFrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesEPSS 0.6%CVE-2026-27590HIGHCaddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transportEPSS 0.5%CVE-2026-52747HIGHModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassEPSS 0.5%CVE-2025-29787HIGHzip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File WriteEPSS 0.5%CVE-2026-49984HIGHKestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)EPSS 0.5%CVE-2026-15704CRITICALCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go ComponentsEPSS 0.4%CVE-2026-39409MEDIUMHono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesEPSS 0.3%CVE-2026-62999HIGHCopier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)EPSS 0.3%CVE-2026-7120MEDIUM@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL PathsEPSS 0.2%CVE-2026-69246HIGHGuzzle: Noncanonical host can bypass host-based checksEPSS 0.2%CVE-2026-34475MEDIUMVarnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / EPSS 0.2%CVE-2026-34786MEDIUMRack: Rack::Static header_rules bypass via URL-encoded pathsEPSS 0.2%CVE-2026-42462HIGHFedify has an LD-Signature Bypass via JSON-LD Named-Graph RestructuringEPSS 0.2%CVE-2026-45022HIGHgo-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream GitEPSS 0.2%CVE-2024-28607LOWThe ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as gloEPSS 0.1%CVE-2026-48721HIGHWarp: Env-var prefixes can lead to denylisted command autoexecutionEPSS 0.1%