CWE-178, Improper Handling of Case Sensitivity, describes a product that does not account for differences in case sensitivity when it accesses a resource or reads its properties. The result is inconsistent answers to the same question. It shows up in web servers, file handlers, login systems and anywhere names are compared.
How it happens
Operating systems disagree. MITRE notes the weakness applies on Windows and macOS as well as in platform neutral code, because file systems there commonly ignore case while application logic does not.
Picture a rule that blocks requests for one file type, written as an exact match on lower case text. A request using the upper case form passes the rule, then lands on a case-insensitive file system that serves it anyway.
MITRE's examples are older but clear. In CVE-2000-0499, an application server could be tricked into returning JSP source by requesting an upper case JSP extension. CVE-2000-0497 and CVE-2000-0498 describe servers where handlers treated .jsp and .JSP as different, so the upper case form defaulted to plain text and exposed source code. In CVE-2001-0766 a URL with characters whose case the server filters did not match could bypass access restrictions on a case-insensitive file system.
The extended description adds another case: case-insensitive passwords shrink the key space and make brute force easier.
What an attacker gains
MITRE lists access control bypass and bypass of a protection mechanism. That covers reading source code, reaching restricted paths, and weakening credentials.
How to find it
Test every access rule with variations in case. Try the upper case form of every blocked path, extension and username. Review code for comparisons that use exact equality on names that the underlying system treats loosely.
How to fix it
The record lists no mitigations, so treat these as general practice.
- Pick one canonical case, usually by lowercasing with a locale safe method, and convert before comparing.
- Make the access rule and the resource lookup use the same comparison.
- Do not shorten the key space on credentials by ignoring case unless that is a deliberate, documented choice.
- Test on the file systems you deploy to, not only on your laptop.
Quick check
Why does this matter more on Windows and macOS?
Their default file systems ignore case, so a request that fails an exact match filter can still resolve to the real file.
