CAPEC-64

Using Slashes and URL Encoding Combined to Bypass Validation Logic

High severityHigh likelihoodDetailed pattern

This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.

On this page

Ask an AI about this attack pattern
How the attack unfolds
Prerequisites
Skills required
Signs of an attack
Consequences
Mitigations
Weaknesses it exploits
Related attack patterns
Examples

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/64.html and https://cve.bz/cve/capec/64?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

Explore
The attacker looks for a way in.
1. The attacker accesses the server using a specific URL.
Experiment
They probe what they found.
1. The attacker tries to encode some special characters in the URL. The attacker find out that some characters are not filtered properly.
Exploit
They carry out the attack.
1. The attacker crafts a malicious URL string request and sends it to the server.
2. The server decodes and interprets the URL string. Unfortunately since the input filtering is not done properly, the special characters have harmful consequences.

Prerequisites

The application accepts and decodes URL string request.
The application performs insufficient filtering/canonicalization on the URLs.

Skills required

Low skill
An attacker can try special characters in the URL and bypass the URL validation.
Medium skill
The attacker may write a script to defeat the input filtering mechanism.

Signs of an attack

If the first decoding process has left some invalid or denylisted characters, that may be a sign that the request is malicious.
Traffic filtering with IDS (or proxy) can detect requests with suspicious URLs. IDS may use signature based identification to reveal such URL based attacks.

Consequences

What a successful attack can lead to
Impact	Affects	Note
Resource Consumption	Availability	Denial of Service
Execute Unauthorized Commands	Confidentiality, Integrity, Availability	Run Arbitrary Code
Read Data	Confidentiality
Gain Privileges	Confidentiality, Access Control, Authorization

Mitigations

Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input.
Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding.
When client input is required from web-based forms, avoid using the "GET" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the "POST method whenever possible.
Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process.
Refer to the RFCs to safely decode URL.
Regular expression can be used to match safe URL patterns. However, that may discard valid URL requests if the regular expression is too restrictive.
There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx).

Weaknesses it exploits

CWE-20 Improper Input Validation
CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-73 External Control of File Name or Path
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-172 Improper Encoding or Decoding of Data
CWE-173 Improper Handling of Alternate Encoding
CWE-177 Improper Handling of URL Encoding (Hex Encoding)
CWE-697 Incorrect Comparison
CWE-707 Improper Neutralization

Recent CVEs with these weaknesses

4.9CVE-2026-1054272026-11-10
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.
6.7CVE-2026-1054262026-11-10
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.
5.5CVE-2026-1231812026-11-10
A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.
–CVE-2026-978812026-11-10
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block ne…
9.6CVE-2026-1081862026-11-10
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
8.2CVE-2026-1257532026-11-10
ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can…
–CVE-2026-868112026-11-10
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or writt…
6.3CVE-2026-1258712026-11-10
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-267 Leverage Alternate Encoding

Examples

Attack Example: Combined Encodings CesarFTP

Alexandre Cesari released a freeware FTP server for Windows that fails to provide proper filtering against multiple encoding. The FTP server, CesarFTP, included a Web server component that could be attacked with a combination of the triple-dot and URL encoding attacks.

An attacker could provide a URL that included a string like

/...%5C/

This is an interesting exploit because it involves an aggregation of several tricks: the escape character, URL encoding, and the triple dot.