Common Weakness Enumeration
CWE-647
AllowedUse of Non-Canonical URL Paths for Authorization Decisions
Abstraction: Variant · Status: Incomplete
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
22 vulnerabilities reference this CWE, most recent first.
GHSA-WHQG-PPGF-WP8C
Vulnerability from github – Published: 2025-12-08 16:26 – Updated: 2025-12-09 16:28
VLAI
Summary
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Details
Authentication Bypass via Double URL Encoding in Astro
Bypass for CVE-2025-64765 / GHSA-ggxq-hp9w-j794
Summary
A double URL encoding bypass allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like /%2561dmin instead of /%61dmin, attackers can still bypass authentication and access protected resources such as /admin, /api/internal, or any route protected by middleware pathname checks.
Fix
A more secure fix is just decoding once, then if the request has a %xx format, return a 400 error by using something like :
if (containsEncodedCharacters(pathname)) {
// Multi-level encoding detected - reject request
return new Response(
'Bad Request: Multi-level URL encoding is not allowed',
{
status: 400,
headers: { 'Content-Type': 'text/plain' }
}
);
}
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "astro"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66202"
],
"database_specific": {
"cwe_ids": [
"CWE-647"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-08T16:26:43Z",
"nvd_published_at": "2025-12-09T00:15:48Z",
"severity": "MODERATE"
},
"details": "# Authentication Bypass via Double URL Encoding in Astro\n## Bypass for CVE-2025-64765 / GHSA-ggxq-hp9w-j794\n\n---\n\n### Summary\n\nA **double URL encoding bypass** allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like `/%2561dmin` instead of `/%61dmin`, attackers can still bypass authentication and access protected resources such as `/admin`, `/api/internal`, or any route protected by middleware pathname checks.\n\n\n## Fix \n\nA more secure fix is just decoding once, then if the request has a %xx format, return a 400 error by using something like :\n\n```\nif (containsEncodedCharacters(pathname)) {\n // Multi-level encoding detected - reject request\n return new Response(\n \u0027Bad Request: Multi-level URL encoding is not allowed\u0027,\n {\n status: 400,\n headers: { \u0027Content-Type\u0027: \u0027text/plain\u0027 }\n }\n );\n }\n```",
"id": "GHSA-whqg-ppgf-wp8c",
"modified": "2025-12-09T16:28:41Z",
"published": "2025-12-08T16:26:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64765"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66202"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce"
},
{
"type": "PACKAGE",
"url": "https://github.com/withastro/astro"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765"
}
GHSA-X39X-9QW5-GHRF
Vulnerability from github – Published: 2025-05-05 18:25 – Updated: 2025-05-05 18:25
VLAI
Summary
Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
Details
Summary
During a manual source code review, ARIMLABS.AI researchers identified that the browser_use module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can be bypassed, leading to severe security implications.
Details
File: browser_use/browser/context.py
The BrowserContextConfig class defines an allowed_domains list, which is intended to limit accessible domains. This list is checked in the _is_url_allowed() method before navigation:
@dataclass
class BrowserContextConfig:
"""
[STRIPPED]
"""
cookies_file: str | None = None
minimum_wait_page_load_time: float = 0.5
wait_for_network_idle_page_load_time: float = 1
maximum_wait_page_load_time: float = 5
wait_between_actions: float = 1
disable_security: bool = True
browser_window_size: BrowserContextWindowSize = field(default_factory=lambda: {'width': 1280, 'height': 1100})
no_viewport: Optional[bool] = None
save_recording_path: str | None = None
save_downloads_path: str | None = None
trace_path: str | None = None
locale: str | None = None
user_agent: str = (
'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36'
)
highlight_elements: bool = True
viewport_expansion: int = 500
allowed_domains: list[str] | None = None
include_dynamic_attributes: bool = True
_force_keep_context_alive: bool = False
The _is_url_allowed() method is responsible for checking whether a given URL is permitted:
def _is_url_allowed(self, url: str) -> bool:
"""Check if a URL is allowed based on the whitelist configuration."""
if not self.config.allowed_domains:
return True
try:
from urllib.parse import urlparse
parsed_url = urlparse(url)
domain = parsed_url.netloc.lower()
# Remove port number if present
if ':' in domain:
domain = domain.split(':')[0]
# Check if domain matches any allowed domain pattern
return any(
domain == allowed_domain.lower() or domain.endswith('.' + allowed_domain.lower())
for allowed_domain in self.config.allowed_domains
)
except Exception as e:
logger.error(f'Error checking URL allowlist: {str(e)}')
return False
The core issue stems from the line domain = domain.split(':')[0], which allows an attacker to manipulate basic authentication credentials by providing a username:password pair. By replacing the username with a whitelisted domain, the check can be bypassed, even though the actual domain remains different.
Proof of Concept (PoC)
Set allowed_domains to ['example.com'] and use the following URL:
https://example.com:pass@localhost:8080
This allows bypassing all whitelist controls and accessing restricted internal services.
Impact
- Affected all users relying on this functionality for security.
- Potential for unauthorized enumeration of localhost services and internal networks.
- Ability to bypass domain whitelisting, leading to unauthorized browsing.
Severity
9.3 (Critical)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.1.44"
},
"package": {
"ecosystem": "PyPI",
"name": "browser-use"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.45"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-47241"
],
"database_specific": {
"cwe_ids": [
"CWE-647"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-05T18:25:04Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary \nDuring a manual source code review, [**ARIMLABS.AI**](https://arimlabs.ai) researchers identified that the `browser_use` module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can be bypassed, leading to severe security implications. \n\n### Details \n**File:** `browser_use/browser/context.py` \n\nThe `BrowserContextConfig` class defines an `allowed_domains` list, which is intended to limit accessible domains. This list is checked in the `_is_url_allowed()` method before navigation:\n\n```python\n@dataclass\nclass BrowserContextConfig:\n \"\"\"\n [STRIPPED]\n \"\"\"\n cookies_file: str | None = None\n minimum_wait_page_load_time: float = 0.5\n wait_for_network_idle_page_load_time: float = 1\n maximum_wait_page_load_time: float = 5\n wait_between_actions: float = 1\n\n disable_security: bool = True\n\n browser_window_size: BrowserContextWindowSize = field(default_factory=lambda: {\u0027width\u0027: 1280, \u0027height\u0027: 1100})\n no_viewport: Optional[bool] = None\n\n save_recording_path: str | None = None\n save_downloads_path: str | None = None\n trace_path: str | None = None\n locale: str | None = None\n user_agent: str = (\n \u0027Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\u0027\n )\n\n highlight_elements: bool = True\n viewport_expansion: int = 500\n allowed_domains: list[str] | None = None\n include_dynamic_attributes: bool = True\n\n _force_keep_context_alive: bool = False\n```\nThe _is_url_allowed() method is responsible for checking whether a given URL is permitted:\n```python\ndef _is_url_allowed(self, url: str) -\u003e bool:\n \"\"\"Check if a URL is allowed based on the whitelist configuration.\"\"\"\n if not self.config.allowed_domains:\n return True\n\n try:\n from urllib.parse import urlparse\n\n parsed_url = urlparse(url)\n domain = parsed_url.netloc.lower()\n\n # Remove port number if present\n if \u0027:\u0027 in domain:\n domain = domain.split(\u0027:\u0027)[0]\n\n # Check if domain matches any allowed domain pattern\n return any(\n domain == allowed_domain.lower() or domain.endswith(\u0027.\u0027 + allowed_domain.lower())\n for allowed_domain in self.config.allowed_domains\n )\n except Exception as e:\n logger.error(f\u0027Error checking URL allowlist: {str(e)}\u0027)\n return False\n```\nThe core issue stems from the line `domain = domain.split(\u0027:\u0027)[0]`, which allows an attacker to manipulate basic authentication credentials by providing a username:password pair. By replacing the username with a whitelisted domain, the check can be bypassed, even though the actual domain remains different.\n### Proof of Concept (PoC)\n\nSet allowed_domains to [\u0027example.com\u0027] and use the following URL:\n\nhttps://example.com:pass@localhost:8080\n\nThis allows bypassing all whitelist controls and accessing restricted internal services.\n### Impact\n\n- Affected all users relying on this functionality for security.\n- Potential for unauthorized enumeration of localhost services and internal networks.\n- Ability to bypass domain whitelisting, leading to unauthorized browsing.",
"id": "GHSA-x39x-9qw5-ghrf",
"modified": "2025-05-05T18:25:04Z",
"published": "2025-05-05T18:25:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47241"
},
{
"type": "WEB",
"url": "https://github.com/browser-use/browser-use/pull/1561"
},
{
"type": "PACKAGE",
"url": "https://github.com/browser-use/browser-use"
},
{
"type": "WEB",
"url": "https://github.com/browser-use/browser-use/releases/tag/0.1.45"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL"
}
Mitigation
Architecture and Design
Make access control policy based on path information in canonical form. Use very restrictive regular expressions to validate that the path is in the expected form.
Mitigation
Architecture and Design
Reject all alternate path encodings that are not in the expected canonical form.
No CAPEC attack patterns related to this CWE.