CWE-647

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

{"xhtml:p":["If an application defines policy namespaces and makes authorization decisions based on the URL, but it does not require or convert to a canonical URL before making the authorization decision, then it opens the application to attack. For example, if the application only wants to allow access to http://www.example.com/mypage, then the attacker might be able to bypass this restriction using equivalent URLs such as:","Therefore it is important to specify access control policy that is based on the path information in some canonical form with all alternate encodings rejected (which can be accomplished by a default deny rule)."],"xhtml:ul":[{"xhtml:li":["http://WWW.EXAMPLE.COM/mypage","http://www.example.com/%6Dypage (alternate encoding)","http://192.168.1.1/mypage (IP address)","http://www.example.com/mypage/ (trailing /)","http://www.example.com:80/mypage"]}]}

Applicable Platforms