CWE-647 (使用未经净化的URL路径进行授权决策) — Vulnerability Class 12

12 vulnerabilities classified as CWE-647 (使用未经净化的URL路径进行授权决策). AI Chinese analysis included.

CWE-647 represents a critical authorization weakness where applications rely on non-canonical URL representations to enforce security policies. This flaw occurs when software assumes a requested URL is unique or standardized, failing to normalize paths before evaluating access rights. Attackers typically exploit this by submitting obfuscated or redundant URL variations, such as using double slashes, dot-dot sequences, or case mismatches, to bypass intended restrictions and access protected resources. To mitigate this risk, developers must implement robust input normalization routines that convert all incoming URLs into a strict canonical format before processing authorization logic. By ensuring that every request is evaluated against a consistent, standardized path representation, organizations can effectively prevent attackers from leveraging URL ambiguities to circumvent security controls and maintain the integrity of their access management systems.

MITRE CWE Description

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization. If an application defines policy namespaces and makes authorization decisions based on the URL, but it does not require or convert to a canonical URL before making the authorization decision, then it opens the application to attack. For example, if the application only wants to allow access to http://www.example.com/mypage, then the attacker might be able to bypass this restriction using equivalent URLs such as: http://WWW.EXAMPLE.COM/mypage http://www.example.com/%6Dypage (alternate encoding) http://192.168.1.1/mypage (IP address) http://www.example.com/mypage/ (trailing /) http://www.example.com:80/mypage Therefore it is important to specify access control policy that is based on the path information in some canonical form with all alternate encodings rejected (which can be accomplished by a default deny rule).

Common Consequences (2)

Access Control Bypass Protection Mechanism

An attacker may be able to bypass the authorization mechanism to gain access to the otherwise-protected URL.

Confidentiality Read Files or Directories

If a non-canonical URL is used, the server may choose to return the contents of the file, instead of pre-processing the file (e.g. as a program).

Mitigations (2)

Architecture and Design Make access control policy based on path information in canonical form. Use very restrictive regular expressions to validate that the path is in the expected form.

Architecture and Design Reject all alternate path encodings that are not in the expected canonical form.

Examples (1)

Example from CAPEC (CAPEC ID: 4, "Using Alternative IP Address Encodings"). An attacker identifies an application server that applies a security policy based on the domain and application name, so the access control policy covers authentication and authorization for anyone accessing http://example.domain:8080/application. However, by putting in the IP address of the host the application authentica…

CVE ID	Title	CVSS	Severity	Published
CVE-2026-80515	Eclipse Arrowhead 授权问题漏洞 — Eclipse Arrowhead	8.9	High	2026-09-03
CVE-2026-15970	L7 intention authorization bypass via custom public listener — Consul	4.2	Medium	2026-08-07
CVE-2026-62685	File Browser: Colliding username normalization gives two users the same home directory — filebrowser	8.1	High	2026-07-15
CVE-2026-8384	Eclipse jetty 授权问题漏洞 — Eclipse Jetty	5.3	Medium	2026-07-14
CVE-2026-59731	Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch — astro	8.2	High	2026-07-08
CVE-2026-5222	Cargo can be coerced to share credentials between registries — Cargo	-	-	2026-05-25
CVE-2025-9909	Aap-gateway: improper path validation in gateway allows credential exfiltration — Red Hat Ansible Automation Platform 2.5 for RHEL 8	6.7	Medium	2026-02-27
CVE-2025-66202	Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 — astro	6.5	Medium	2025-12-08
CVE-2025-64500	Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass — symfony	7.3	High	2025-11-12
CVE-2025-47241	Browser Use 安全漏洞 — browser-use	4.0	Medium	2025-05-03
CVE-2025-43916	Sonos api.sonos.com 安全漏洞 — api.sonos.com	3.4	Low	2025-04-21
CVE-2022-43939	Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions — Pentaho Business Analytics Server	8.6	High	2023-04-03

Vulnerabilities classified as CWE-647 (使用未经净化的URL路径进行授权决策) represent 12 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.