Skip to content
Threat Feed
Subscribe

Tag

Url-Encoding

2 briefs RSS
critical advisory

S3-Proxy Authentication Bypass via Percent-Encoded Slashes

S3-Proxy is vulnerable to an authentication bypass due to inconsistent handling of percent-encoded slashes between the authentication middleware and bucket handler, allowing unauthorized access to protected resources.

s3-proxy authentication-bypass url-encoding
2r 1t
high advisory

Heimdall Authorization Bypass via Case-Sensitive URL-Encoded Slash Handling

Heimdall versions before 0.17.14 are vulnerable to inconsistent path interpretation due to case-sensitive handling of URL-encoded slashes; when `allow_encoded_slashes` is set to `off` (the default), the lowercase `%2f` is not recognized, potentially leading to authorization bypass if the default rule is overly permissive and the upstream service interprets `%2f` as a path separator.

Heimdall authorization-bypass url-encoding
2r 1t