What is Improper Neutralization of Encoded URI (CWE-84)?

TL;DR: Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84) is a web application security vulnerability that occurs when the application fails to properly neutralize user-controlled input for executable script disguised with URI encodings. It can lead to potential security vulnerabilities, including unexpected state and integrity loss.

At-a-Glance

What is Improper Neutralization of Encoded URI Schemes in a Web Page?

Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84) is a type of web application security vulnerability that occurs when the application fails to properly neutralize user-controlled input for executable script disguised with URI encodings. As defined by the MITRE Corporation under CWE-84, and classified by the OWASP Foundation under Injection (A9:2021), this vulnerability can lead to potential security vulnerabilities.

Quick Summary

Improper Neutralization of Encoded URI Schemes in a Web Page is a critical web application security vulnerability that occurs when the application fails to properly neutralize user-controlled input for executable script disguised with URI encodings. This vulnerability can lead to unexpected state, integrity loss, and potential security vulnerabilities. It’s essential to detect and fix this issue promptly to prevent attacks.

Jump to: Quick Summary · Improper Neutralization of Encoded URI Schemes in a Web Page Overview · How Improper Neutralization of Encoded URI Schemes in a Web Page Works · Business Impact of Improper Neutralization of Encoded URI Schemes in a Web Page · Improper Neutralization of Encoded URI Schemes in a Web Page Attack Scenario · How to Detect Improper Neutralization of Encoded URI Schemes in a Web Page · How to Fix Improper Neutralization of Encoded URI Schemes in a Web Page · Framework-Specific Fixes for Improper Neutralization of Encoded URI Schemes in a Web Page · How to Ask AI to Check Your Code for Improper Neutralization of Encoded URI Schemes in a Web Page · Improper Neutralization of Encoded URI Schemes in a Web Page Best Practices Checklist · Improper Neutralization of Encoded URI Schemes in a Web Page FAQ · Vulnerabilities Related to Improper Neutralization of Encoded URI Schemes in a Web Page · References · Scan Your Own Site

Improper Neutralization of Encoded URI Schemes in a Web Page Overview

Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84) is a web application security vulnerability that occurs when the application fails to properly neutralize user-controlled input for executable script disguised with URI encodings. This can happen due to various reasons, including:

• The application not properly validating or sanitizing user input.
• The application not using output encoding to prevent malicious scripts from being executed.

How Improper Neutralization of Encoded URI Schemes in a Web Page Works

Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84) works by exploiting the vulnerability in the web application. Here’s an overview of how it works:

Root Cause

The root cause of this vulnerability is the failure of the web application to properly neutralize user-controlled input for executable script disguised with URI encodings.

Attack Flow

1. An attacker sends a malicious request to the web application, containing encoded URI schemes.
2. The web application fails to properly validate or sanitize the user input, allowing the malicious scripts to be executed.
3. The malicious scripts are executed, leading to potential security vulnerabilities.

Prerequisites to Exploit

• The web application must not properly validate or sanitize user input.
• The web application must use output encoding that is vulnerable to malicious scripts.

Vulnerable Code

import urllib.parse

def process_request(request):
    # Vulnerable code: fails to properly validate or sanitize user input
    encoded_uri = request.get('encoded_uri')
    if encoded_uri:
        return urllib.parse.unquote(encoded_uri)

The above code is vulnerable because it fails to properly validate or sanitize the encoded_uri parameter.

Secure Code

import urllib.parse

def process_request(request):
    # Secure code: uses output encoding to prevent malicious scripts from being executed
    encoded_uri = request.get('encoded_uri')
    if encoded_uri:
        return urllib.parse.quote(encoded_uri)

The above code is secure because it uses output encoding to prevent malicious scripts from being executed.

Business Impact of Improper Neutralization of Encoded URI Schemes in a Web Page

Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84) can have significant business impacts, including:

• Unexpected state: The web application may enter an unexpected state, leading to potential security vulnerabilities.
• Integrity loss: The web application may lose integrity, allowing malicious scripts to be executed.

Improper Neutralization of Encoded URI Schemes in a Web Page Attack Scenario

Here’s an example attack scenario for Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84):

1. An attacker sends a malicious request to the web application, containing encoded URI schemes.
2. The web application fails to properly validate or sanitize the user input, allowing the malicious scripts to be executed.
3. The malicious scripts are executed, leading to potential security vulnerabilities.

How to Detect Improper Neutralization of Encoded URI Schemes in a Web Page

Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84) can be detected through various methods, including:

Manual Testing

• Submit script-scheme payloads using encoded variants (java%73cript:, HTML entity-encoded javascript:, mixed-case, embedded tabs/newlines inside the scheme name) into any field that’s rendered as a link href or similar URI-accepting attribute.
• Confirm the application’s neutralization decodes and normalizes the value before checking it, rather than pattern-matching only the literal, unencoded javascript: string.

Automated Scanners (SAST / DAST)

Static analysis can flag a URI-scheme check that pattern-matches a literal string instead of decoding first; dynamic testing is needed to confirm the running application actually rejects encoded variants of the dangerous scheme, since the check can look correct in source while still being bypassable at runtime.

PenScan Detection

PenScan’s ZAP and Dalfox engines actively test URI-accepting fields with encoded script-scheme payloads.

False Positive Guidance

A finding on a URI value that’s already validated against an allowlist of safe schemes (https:, mailto:, etc.) after decoding, rather than a denylist of dangerous ones, is a false positive.

How to Fix Improper Neutralization of Encoded URI Schemes in a Web Page

Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84) can be fixed by:

• Resolving all URIs to absolute or canonical representations before processing.
• Carefully checking each input parameter against a rigorous positive specification.
• Using output encoding to prevent malicious scripts from being executed.

Framework-Specific Fixes for Improper Neutralization of Encoded URI Schemes in a Web Page

Here are some framework-specific fixes for Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84):

Java

import java.net.URI;

public class ProcessRequest {
    public static String processRequest(String encodedUri) {
        // Secure code: uses output encoding to prevent malicious scripts from being executed
        return URI.create(encodedUri).toString();
    }
}

Node.js

const express = require('express');
const app = express();

app.get('/process-request', (req, res) => {
    const encodedUri = req.query.encoded_uri;
    if (encodedUri) {
        // Secure code: uses output encoding to prevent malicious scripts from being executed
        return res.send(encodeURIComponent(encodedUri));
    }
});

Python/Django

from urllib.parse import quote

def process_request(request):
    # Secure code: uses output encoding to prevent malicious scripts from being executed
    encoded_uri = request.GET.get('encoded_uri')
    if encoded_uri:
        return quote(encoded_uri)

How to Ask AI to Check Your Code for Improper Neutralization of Encoded URI Schemes in a Web Page

To ask an AI coding assistant to check your code for Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84), you can use the following prompt:

Review the following Python/Django code block for potential CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page vulnerabilities and rewrite it using output encoding:

from urllib.parse import unquote

def process_request(request):
    encoded_uri = request.GET.get('encoded_uri')
    if encoded_uri:
        return unquote(encoded_uri)

Improper Neutralization of Encoded URI Schemes in a Web Page Best Practices Checklist

Here’s a best practices checklist for Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84):

✅ Always properly validate and sanitize user input. ✅ Use output encoding to prevent malicious scripts from being executed. ✅ Regularly test the web application for potential security vulnerabilities.

Improper Neutralization of Encoded URI Schemes in a Web Page FAQ

How does Improper Neutralization of Encoded URI Schemes in a Web Page occur?

Improper neutralization of encoded URI schemes in a web page occurs when the application fails to properly neutralize user-controlled input for executable script disguised with URI encodings.

What are the consequences of Improper Neutralization of Encoded URI Schemes in a Web Page?

The consequences of Improper Neutralization of Encoded URI Schemes in a Web Page include unexpected state, integrity loss, and potential security vulnerabilities.

How can I detect Improper Neutralization of Encoded URI Schemes in a Web Page?

You can detect Improper Neutralization of Encoded URI Schemes in a Web Page through manual testing, automated scanners (SAST / DAST), and PenScan detection.

What are the best practices for preventing Improper Neutralization of Encoded URI Schemes in a Web Page?

The best practices for preventing Improper Neutralization of Encoded URI Schemes in a Web Page include input validation, output encoding, and attack surface reduction.

How can I fix Improper Neutralization of Encoded URI Schemes in a Web Page?

You can fix Improper Neutralization of Encoded URI Schemes in a Web Page by resolving all URIs to absolute or canonical representations before processing, carefully checking each input parameter against a rigorous positive specification, and using output encoding.

What are the related vulnerabilities to Improper Neutralization of Encoded URI Schemes in a Web Page?

The related vulnerabilities to Improper Neutralization of Encoded URI Schemes in a Web Page include CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).

What are the references for Improper Neutralization of Encoded URI Schemes in a Web Page?

The references for Improper Neutralization of Encoded URI Schemes in a Web Page include the CWE-84 definition, OWASP A9:2021 - Injection, and CAPEC.

Vulnerabilities Related to Improper Neutralization of Encoded URI Schemes in a Web Page

Here are some vulnerabilities related to Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84):

References

Here are some references for Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84):

• CWE-84 definition: https://cwe.mitre.org/data/definitions/84.html
• CAPEC: None known
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Neutralization of Encoded URI Schemes in a Web Page and other risks before an attacker does.