Falhas do tipo CWE-180

48 resultados

Validação antes da canonicalização

Ocorre quando o código valida dados de entrada antes de normalizá-los para sua forma canônica. O atacante contorna a validação usando representações alternativas (codificações, espaços, barras extras) que passam na verificação, mas depois são processadas de forma diferente. A ordem correta é normalizar primeiro, depois validar.

Exemplo

Um WAF valida a URL '/admin/users' como proibida, mas deixa passar '//admin/users' ou '/admin/../admin/users' porque a barra dupla ou o .. ainda não foram normalizados. O servidor canonicaliza e acessa '/admin/users' mesmo assim, contornando a proteção.

Como mitigar

Sempre canonicalize (normalize, decodifique, expanda) a entrada antes de qualquer validação. Valide apenas a forma final que o sistema realmente processará. Use funções de normalização da linguagem ou framework (ex: realpath() em PHP, normalize() em Java) e nunca confie em validação prévia.

CVE-2026-15704CRITICALCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go ComponentsEPSS 0.5%CVE-2026-62999HIGHCopier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)EPSS 0.4%CVE-2026-112003MEDIUMProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteEPSS 0.4%CVE-2026-76203MEDIUMCSS sanitizer bypass in Pentestify report themes allows forced outbound requestsEPSS 0.4%CVE-2026-69246HIGHGuzzle: Noncanonical host can bypass host-based checksEPSS 0.4%CVE-2026-7120MEDIUM@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL PathsEPSS 0.4%CVE-2026-39409MEDIUMHono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesEPSS 0.3%CVE-2026-72917MEDIUMAnythingLLM: Password recovery accepts one recovery code twice after whitespace normalizationEPSS 0.3%CVE-2026-118662MEDIUMVite: `server.fs.deny` bypassed with queriesEPSS 0.3%CVE-2026-93630MEDIUMZimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname CanonicalizationEPSS 0.3%CVE-2026-79300LOWSEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can crEPSS 0.3%CVE-2026-110306MEDIUMfast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingEPSS 0.3%CVE-2026-93326MEDIUMCrafted Git build source can bypass certain policy validationEPSS 0.2%CVE-2026-100674MEDIUMstoatchat before 0.15.5 Username Validation Bypass via Unicode SanitizationEPSS 0.2%CVE-2026-97764LOWdjango-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attackerEPSS 0.2%CVE-2026-102269MEDIUMPyJWT: Non-canonical signature segments enable raw-token revocation bypassEPSS 0.2%CVE-2026-48721HIGHWarp: Env-var prefixes can lead to denylisted command autoexecutionEPSS 0.2%CVE-2026-34475MEDIUMVarnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / EPSS 0.2%CVE-2026-34786MEDIUMRack: Rack::Static header_rules bypass via URL-encoded pathsEPSS 0.2%CVE-2026-69245MEDIUMGuzzle: Noncanonical cookie domain keeps subdomain scopeEPSS 0.2%