1859
However, the URL above is comprised of Cyrillic characters that look identical to the expected
ASCII characters. This results in most users not being able to distinguish between the two and
assuming that the above URL is trusted and safe. The "e" is actually the "CYRILLIC SMALL
LETTER IE" which is represented in HTML as the character &#x435, while the "a" is actually
the "CYRILLIC SMALL LETTER A" which is represented in HTML as the character &#x430. The
"p", "c", and "o" are also Cyrillic characters in this example. Viewing the source reveals a URL of
"http://www.&#x435;x&#x430;m&#x440;l&#x435;.&#x441;&#x43e;m". An adversary can utilize
this approach to perform an attack such as a phishing attack in order to drive traffic to a malicious
website.
Example 2:
The following displays an example of how creating usernames containing homoglyphs can lead to
log forgery.
Assume an adversary visits a legitimate, trusted domain and creates an account named "admin",
except the 'a' and 'i' characters are Cyrillic characters instead of the expected ASCII. Any actions
the adversary performs will be saved to the log file and look like they came from a legitimate
administrator account.
Example Language: (Result)
123.123.123.123 #dm#n [17/Jul/2017:09:05:49 -0400] "GET /example/users/userlist HTTP/1.1" 401 12846
123.123.123.123 #dm#n [17/Jul/2017:09:06:51 -0400] "GET /example/users/userlist HTTP/1.1" 200 4523
123.123.123.123 admin [17/Jul/2017:09:10:02 -0400] "GET /example/users/editusers HTTP/1.1" 200 6291
123.123.123.123 #dm#n [17/Jul/2017:09:10:02 -0400] "GET /example/users/editusers HTTP/1.1" 200 6291
Upon closer inspection, the account that generated three of these log entries is
"&#x430;dm&#x456;n". Only the third log entry is by the legitimate admin account. This makes it
more difficult to determine which actions were performed by the adversary and which actions were
executed by the legitimate "admin" account.
Observed Examples
Reference Description
CVE-2013-7236 web forum allows impersonation of users with homoglyphs in account names
https://www.cve.org/CVERecord?id=CVE-2013-7236
CVE-2012-0584 Improper character restriction in URLs in web browser
https://www.cve.org/CVERecord?id=CVE-2012-0584
CVE-2009-0652 Incomplete denylist does not include homoglyphs of "/" and "?" characters in
URLs
https://www.cve.org/CVERecord?id=CVE-2009-0652
CVE-2017-5015 web browser does not convert hyphens to punycode, allowing IDN spoofing in
URLs
https://www.cve.org/CVERecord?id=CVE-2017-5015
CVE-2005-0233 homoglyph spoofing using punycode in URLs and certificates
https://www.cve.org/CVERecord?id=CVE-2005-0233
CVE-2005-0234 homoglyph spoofing using punycode in URLs and certificates
https://www.cve.org/CVERecord?id=CVE-2005-0234
CVE-2005-0235 homoglyph spoofing using punycode in URLs and certificates
https://www.cve.org/CVERecord?id=CVE-2005-0235
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
CWE Version 4.14
CWE-1021: Improper Restriction of Rendered UI Layers or Frames
CWE-1021: Improper Restriction of Rendered UI Layers or Frames