Using Similar Unicode Characters to Bypass Authentication

GitHub turned is subject to an attack that allows you to seize access to an account through the manipulation of Unicode characters in email. The problem is related to the fact that some Unicode characters, when applied to lowercase or uppercase conversion functions, are translated into ordinary characters that are close in shape (when several different characters are translated into one character - for example, the Turkish character "ı" and "i" when cast to uppercase are converted to "I").

Before checking the login parameters in some services and applications, the data transmitted by the user is first converted to upper or lower case, and then checked in the database. If the service allows the use of unicode characters in the login or email, then an attacker can use similar unicode characters to perform an attack that manipulates collisions in the Unicode Case Mapping Collisions tables.

'ß'.toUpperCase() == 'ss'.toUpperCase() // 0x0131
'K'.toLowerCase() == 'K'.toLowerCase() // 0x212A
'John@Gıthub.com'.toUpperCase() == '[email protected]'.toUpperCase()

GitHub attacker could through the form for recovering a forgotten password, initiate sending a recovery code to another email by specifying in the form of an address that includes a unicode character that causes a collision (for example, instead of [email protected] specified email mı[email protected]). The address passed the test because it was converted to upper case and matched the original address ([email protected] ), but when sending the letter, it was substituted as is and the recovery code went to a fake address (mı[email protected]).

Some of characters, causing collisions during case conversion:

ß0x00DFSS
I 0x0131 I
ſ 0x017F S
ff0xFB00FF
fi 0xFB01 FI
0xFB02 FL
ffi 0xFB03 FFI
ffl 0xFB04 FFL
ſt 0xFB05 ST
st 0xFB06 ST
K 0x212A k

Source: opennet.ru