86
example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a
directory separator. Another possible error could occur when the filtering is applied in a way that
still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the
".../...//" string in a sequential fashion, two instances of "../" would be removed from the original
string, but the remaining characters would still form the "../" string.
Effectiveness = High
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2001-0687 FTP server allows a remote attacker to retrieve privileged web server system
information by specifying arbitrary paths in the UNC format (\\computername
\sharename).
https://www.cve.org/CVERecord?id=CVE-2001-0687
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER '\\UNC\share\name\' (Windows UNC
share)
Software Fault Patterns SFP16 Path Traversal
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-41: Improper Resolution of Path Equivalence
Weakness ID : 41
Structure : Simple
Abstraction : Base
Description
The product is vulnerable to file system contents disclosure through path equivalence. Path
equivalence involves the use of special characters in file and directory names. The associated
manipulations are intended to generate multiple names for the same object.
Extended Description
Path equivalence is usually employed in order to circumvent access controls expressed using
an incomplete set of file name or file path representations. This is different from path traversal,
wherein the manipulations are performed to generate a name for a different object.
CWE Version 4.14
CWE-41: Improper Resolution of Path Equivalence
CWE-41: Improper Resolution of Path Equivalence