Attack technique for bypassing security measures
Double encoding is the act of encoding data twice in a row using the same encoding scheme. It is usually used as an attack technique to bypass authorization schemes or security filters that intercept user input. In double encoding attacks against security filters, characters of the payload that are treated as illegal by those filters are replaced with their double-encoded form.
Double URI-encoding is a special type of double encoding in which data is URI-encoded twice in a row. It has been used to bypass authorization schemes and security filters against code injection, directory traversal, cross-site scripting (XSS) and SQL injection.
Description.
In double encoding, data is encoded twice in a row using the same encoding scheme, that is, double-encoded form of data codice_1 is codice_2 where codice_3 is an encoding function.
Double encoding is usually used as an attack technique to bypass authorization schemes or security filters that intercept user input. In double encoding attacks against security filters, characters of the payload that are treated as illegal by those filters are replaced with their double-encoded form. Security filters might treat data codice_1 and its encoded form as illegal. However, it is still possible for codice_2, which is the double-encoded form of data codice_1, to not to be treated as illegal by security filters and hence pass through them, but later on, the target system might use the double-decoded form of codice_2, which is codice_1, something that the filters would have been treated as illegal.
Double URI-encoding.
Double URI-encoding, also referred to as double percent-encoding, is a special type of double encoding in which data is URI-encoded twice in a row. In other words, double-URI-encoded form of data codice_1 is codice_10. For example for calculating double-URI-encoded form of codice_11, first codice_11 is URI-encoded as codice_13 which then in turn is URI-encoded as codice_14, that is, codice_15. As another example, for calculating double-URI-encoded form of codice_16, first codice_16 is URI-encoded as codice_18 which then in turn is URI-encoded as codice_19, that is, codice_20.
Double URI-encoding is usually used as an attack technique against web applications and web browsers to bypass authorization schemes and security filters that intercept user input. For example because codice_21 and its URI-encoded form codice_22 are used in some directory traversal attacks, they are usually treated as illegal by security filters. However, it is still possible for codice_23, which is the double-URI-encoded form of codice_21, to not to be treated as illegal by security filters and hence pass through them, but later on, when the target system is building the path related to the directory traversal attack it might use the double-URI-decoded form of codice_23, which is codice_21, something that the filters would have been treated as illegal.
Double URI-encoding attacks have been used to bypass authorization schemes and security filters against code injection, directory traversal, XSS and SQL injection.
Prevention.
Decoding some user input twice using the same decoding scheme, once before a security measure and once afterwards, may allow double encoding attacks to bypass that security measure. Thus, to prevent double encoding attacks, all decoding operations on user input should occur before authorization schemes and security filters that intercept user input.
Examples.
PHP.
In PHP programming language, data items in codice_27 and codice_28 are sufficiently URI-decoded and thus programmers should avoid calling the codice_29 function on them. Calling the codice_29 function on data that has been read from codice_27 or codice_28 causes the data to be URI-decoded once more than it should and hence may open possibility for double URI-encoding attacks.
Directory traversal.
In the following PHP program, the value of codice_33 is used to build the path of the file to be sent to the user. This opens the possibility for directory traversal attacks that incorporate their payload into the HTTP GET parameter codice_34. As a security filter against directory traversal attacks, this program searches the value it reads from codice_33 for directory traversal sequences and exits if it finds one. However, after this filter, the program URI-decodes the data that it has read from codice_33, which makes it vulnerable to double URI-encoding attacks.
 ;?php
/* Note that $_GET is already URI-decoded */
$path = $_GET["file"];
/* Security filter */
/* Exit if user input contains directory traversal sequence */
if (strstr($path, "../") or strstr($path, "..\\"))
 exit("Directory traversal attempt detected.");
/* URI-decode user input once again */
$path = urldecode($path);
/* Build file path to be sent using user input */
echo htmlentities(file_get_contents("uploads/" . $path));
This filter prevents payloads such as codice_37 and its URI-encoded form codice_38. However, codice_39, which is the double-URI-encoded form of codice_37, will bypass this filter. When double-URI-encoded payload codice_39 is used, the value of codice_33 will be codice_38 which doesn't contain any directory traversal sequence and thus passes through the filter and will be given to the codice_29 function which returns codice_37, resulting in a successful attack.
XSS.
In the following PHP program, the value of codice_46 is used to build a message to be shown to the user. This opens the possibility for XSS attacks that incorporate their payload into the HTTP GET parameter codice_47. As a security filter against XSS attacks, this program sanitizes the value it reads from codice_46 via the codice_49 function. However, after this filter, the program URI-decodes the data that it has read from codice_46, which makes it vulnerable to double URI-encoding attacks.
 ;?php
/* Note that $_GET is already URI-decoded */
$name = $_GET["name"];
/* Security filter */
/* Sanitize user input via htmlentity */
$name = htmlentities($name);
/* URI-decode user input once again */
$name = urldecode($name);
/* Build message to be shown using user input */
echo "Hello " . $name;
This filter prevents payloads such as codice_51 and its URI-encoded form codice_52. However, codice_53, which is the double-URI-encoded form of codice_51, will bypass this filter. When double-URI-encoded payload codice_53 is used, the value of codice_46 will be codice_52 which doesn't contain any illegal character and thus passes through the codice_49 function without any change and will be given to the codice_29 function which returns codice_51, resulting in a successful attack.
References.
 ;templatestyles src="Reflist/styles.css" / ;