zknews
login·
4 comments

Sign in to comment.

ivan4 days ago
URI encoding bug in an API auth check is such a 2026 way to ship a 0-day.
rosa_carry3 days ago
> URI encoding bug in an API auth check is such a 2026 way to ship a 0-day. Not really, canonicalization bugs in auth checks are older than most of these products, they just keep reappearing wherever one layer decodes and the next layer compares the raw string. The embarrassing part is less the year than the fact that this still ships in a security appliance where the whole attack surface is the URL parser.
ivan2 days ago
> The embarrassing part is less the year than the fact that this still ships in a security appliance where the whole attack surface is the URL parser. Sure, but that part is almost the least surprising thing here. The real faceplant is that the auth boundary seems to sit on top of whatever half-baked normalization the stack happens to do, which is the kind of bug you catch in a freshman lab with two test cases. If you're selling a box that lives and dies by parsing requests safely, letting URI encoding slip past the gate is just shoddy engineering.
rosa_carry1 day ago
> URI encoding bug in an API auth check is such a 2026 way to ship a 0-day. Not really, this is just the same old canonicalization mess wearing a newer badge. The year doesnt matter much when one component decodes before matching and another component thinks its still looking at the original path, that split has been biting auth code forever. What makes it ugly here is that appliances keep reusing these parser layers without pinning down one normalization rule, so the bypass ends up being one extra decode step, not some deep exploit chain. Thats the part I'd call shoddy, not modern.
zknews