Bypass Logical Validation Using Unicode Characters

Security checks bypass due to a Unicode transformation

If ever a unicode tranformation is performed after some security checks or logical validation, the latter could be bypassed due to a potential Unicode characters collision. The validation of concern are any character escaping, any regex validation or any string verification.

Recommendation

Perform a Unicode normalization before the logical validation.

Example

The following example showcases the bypass of all checks performed by flask.escape() due to a post-unicode normalization.

For instance: the character U+FE64 (﹤) is not filtered-out by the flask escape function. But due to the Unicode normalization, the character is transformed and would become U+003C (< ).

import java.text.Normalizer;

public class BadExampleBypassEscape extends HttpServlet {

    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        String inputEncoded = encodeForHtml(request.getParameter("input"));
        String output = Normalizer.normalize(inputEncoded, Normalizer.Form.NFKC);
        response.getWriter().write(output);
    }

    static String encodeForHtml(String text) {
        return text.replace("<", "&lt;");
    }
}

References

• Research study: Unicode vulnerabilities that could bYte you and Unicode pentest cheatsheet.
• Common Weakness Enumeration: CWE-176.