Bypassing Character Blocklists via Unicode Overflow Attacks
PortSwigger Research has published a detailed analysis of Unicode codepoint truncation, also known as Unicode overflow attacks. This security vulnerability occurs when servers attempt to store multi-byte Unicode characters in single-byte fields, causing an overflow that results in specific ASCII characters due to modulus operations on byte values. For instance, certain high-value codepoints can be crafted to resolve into the letter 'A' after truncation. The research highlights that JavaScript's fromCharCode() method exhibits similar behavior, where exceeding the maximum supported codepoint range leads to predictable character generation through overflow. This technique is currently being actively exploited by bug bounty hunters to bypass input validation and character blocklists. In response to these findings, PortSwigger has updated its ActiveScan++ tool with new detection capabilities for these truncation attacks, following a contribution by Ryan Barnett. Additionally, the team introduced a Hackvertor tag to facilitate the reproduction of these characters and updated the Shazzer unicode table to display potential truncation vectors. The study underscores the importance of robust input handling in web applications to prevent such evasion techniques.
Wire timeline
Bypassing Character Blocklists via Unicode Overflow Attacks
PortSwigger Research has published a detailed analysis of Unicode codepoint truncation, also known as Unicode overflow attacks. This security vulnerability occurs when servers attempt to store multi-byte Unicode characters in single-byte fields, causing an overflow that results in specific ASCII characters due to modulus operations on byte values. For instance, certain high-value codepoints can be crafted to resolve into the letter 'A' after truncation. The research highlights that JavaScript's fromCharCode() method exhibits similar behavior, where exceeding the maximum supported codepoint range leads to predictable character generation through overflow. This technique is currently being actively exploited by bug bounty hunters to bypass input validation and character blocklists. In response to these findings, PortSwigger has updated its ActiveScan++ tool with new detection capabilities for these truncation attacks, following a contribution by Ryan Barnett. Additionally, the team introduced a Hackvertor tag to facilitate the reproduction of these characters and updated the Shazzer unicode table to display potential truncation vectors. The study underscores the importance of robust input handling in web applications to prevent such evasion techniques.
PortSwigger Research