CWE-289, Authentication Bypass by Alternate Name, is a product that performs authentication based on the name of a resource or an actor, but does not check all possible names for it.
Web servers, frameworks, file access layers, and any allowlist or denylist keyed on a string are exposed.
How it happens
One resource can have many names. A URL can be written with percent encoding, a different case, a trailing dot, or a backslash in place of a slash. A host can be reached by several names. A protection rule that matches one spelling lets the others through.
MITRE's examples:
- CVE-2003-0317 (Gold): a protection mechanism that restricts URL access can be bypassed using URL encoding.
- CVE-2004-0847 (Gold): a web framework for .NET lets remote attackers bypass authentication for .aspx files in restricted directories via a request containing a backslash or an encoded backslash.
# Vulnerable: compares the raw path string
if request.path.startswith("/admin"):
require_login()
# "/%61dmin" or "/ADMIN" may reach the same handler without the check
What an attacker gains
MITRE lists bypassing a protection mechanism. The attacker reaches protected content simply by naming it differently.
How to find it
- Test every protected path with encoded, differently cased, and alternate separator variants.
- Compare how the access check parses a name with how the handler parses it. Any difference is a bypass candidate.
- Static analysis can find some instances by examining source code.
How to fix it
Canonicalize the name before any security decision, then check the canonical form, and make sure the check and the use see the same string.
from urllib.parse import unquote
import posixpath
path = posixpath.normpath(unquote(request.path)).lower()
if path.startswith("/admin"):
require_login()
Better still, attach authorization to the handler or resource itself rather than to its path, so no spelling can avoid it.
Quick check
Why is attaching authorization to the handler safer than matching paths?
The handler is the same no matter how the request names it. A path rule only protects the spellings it anticipates.
Sources
- MITRE CWE-289: https://cwe.mitre.org/data/definitions/289.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-289
