CWE-54 is path equivalence using a trailing backslash, as in filedir\. The product accepts that input without appropriate validation, so path resolution is ambiguous. MITRE lists Windows among the platforms, which makes sense, because Windows treats the backslash as a separator.
It belongs to the family under CWE-41.
How it happens
Web servers on Windows commonly accept both slash types in a URL. An access rule that was written for forward slashes sees a different string when a backslash is used, or when it arrives percent encoded as %5C. The file layer then treats the backslash as an ordinary separator and opens the protected file.
The record lists two examples:
- A web framework for .NET allowed remote attackers to bypass authentication for
.aspxfiles in restricted directories via a request containing a backslash or an encoded backslash,%5C(CVE-2004-0847). - A bypass of directory access restrictions using a trailing dot in the URL (CVE-2004-0061).
The first is a clean case of the pattern. The authentication check and the file lookup did not agree about what a backslash means.
// Vulnerable pattern: protect by a forward slash prefix only
if (url.StartsWith("/restricted/") && !user.IsAuthenticated) return Deny();
// "\restricted\page.aspx" or "%5Crestricted%5Cpage.aspx" is not matched
What an attacker gains
MITRE lists reading and modifying files and directories. The recorded effect is bypassing authentication on files in a restricted directory.
How to find it
On a staging copy, request restricted resources with a backslash separator, with %5C, and with a trailing backslash, then compare status and body to the normal request. Review access rules for the separators they handle.
How to fix it
- Decode the URL, convert backslashes to forward slashes, and canonicalize before any rule runs.
- Apply authentication at the directory or prefix level on the normalized path, with deny as the default.
- Reject requests that contain a backslash if your application never needs one.
- Update the framework or server when the bug is in the product.
var path = Uri.UnescapeDataString(rawUrl).Replace('\\', '/');
if (path.Contains('\\')) return BadRequest();
A free scan at gold.safeguard.sh/scan can show known issues in your framework versions with no login.
Quick check
What is %5C?
The percent encoded form of a backslash. After decoding it is a normal separator on Windows, so rules that check before decoding can miss it.
What was the impact in CVE-2004-0847?
Per the record, a bypass of authentication for aspx files in restricted directories.
