CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User

Description:
The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.

Extended Description:
Some glyphs, pictures, or icons can be semantically distinct to a program, while appearing very similar or identical to a human user. These are referred to as homoglyphs. For example, the lowercase "l" (ell) and uppercase "I" (eye) have different character codes, but these characters can be displayed in exactly the same way to a user, depending on the font. This can also occur between different character sets. For example, the Latin capital letter "A" and the Greek capital letter "Α" (Alpha) are treated as distinct by programs, but may be displayed in exactly the same way to a user. Accent marks may also cause letters to appear very similar, such as the Latin capital letter grave mark "À" and its equivalent "Á" with the acute accent. 
             Adversaries can exploit this visual similarity for attacks such as phishing, e.g. by providing a link to an attacker-controlled hostname that looks like a hostname that the victim trusts. In a different use of homoglyphs, an adversary may cre

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-451

Consequences:
  - Integrity: Other

Detection methods:
  - Manual Dynamic Analysis: If utilizing user accounts, attempt to submit a username that contains homoglyphs. Similarly, check to see if links containing homoglyphs can be sent via email, web browsers, or other mechanisms.

Mitigations:
  - [Implementation] Use a browser that displays Punycode for IDNs in the URL and status bars, or which color code various scripts in URLs. 
                   Due to the prominence of homoglyph attacks, several browsers now help safeguard against this attack via the use of Punycode. For example, Mozilla Firefox and Goo
  - [Implementation] Use an email client that has strict filters and prevents messages that mix character sets to end up in a user's inbox. 
                   Certain email clients such as Google's GMail prevent the use of non-Latin characters in email addresses or in links contained within emails. This helps prevent h

Demonstrative examples:
The following looks like a simple, trusted URL that a user may frequently access.
However, the URL above is comprised of Cyrillic characters that look identical to the expected ASCII characters. This results in most users not being able to distinguish between the two and assuming that the above URL is trusted and safe. The "e" is actually the "CYRILLIC SMALL LETTER IE" which is represented in HTML as the character &#x435, while the "a" is actually the "CYRILLIC SMALL LETTER A" which is represented in HTML as the character &#x430.  The "p", "c", and "o" are also Cyrillic characters in this example. Viewing the source reveals a URL of "http://www.&#x435;x&#x430;m&#x440;l&#x435;.&#x441;&#x43e;m". An adversary can utilize this approach to perform an attack such as a phishing attack in order to

The following displays an example of how creating usernames containing homoglyphs can lead to log forgery.
Assume an adversary visits a legitimate, trusted domain and creates an account named "admin", except the 'a' and 'i' characters are Cyrillic characters instead of the expected ASCII. Any actions the adversary performs will be saved to the log file and look like they came from a legitimate administrator account.
123.123.123.123 аdmіn [17/Jul/2017:09:05:49 -0400] "GET /example/users/userlist HTTP/1.1" 401 12846 
		  123.123.123.123 аdmіn [17/Jul/2017:09:06:51 -0400] "GET /example/users/userlist HTTP/1.1" 200 4523 
		  123.123.123.123 admin [17/Jul/2017:09:10:02 -0400] "GET /example/users/editusers HTTP/1.1" 200 6291 
		  123.123.123.123 аdmіn [17/Jul/2017:09:10:02 -0400] "GET /example/u

Real-world examples:
  - CVE-2013-7236: web forum allows impersonation of users with homoglyphs in account names
  - CVE-2012-0584: Improper character restriction in URLs in web browser
  - CVE-2009-0652: Incomplete denylist does not include homoglyphs of "/" and "?" characters in URLs
  - CVE-2017-5015: web browser does not convert hyphens to punycode, allowing IDN spoofing in URLs
  - CVE-2005-0233: homoglyph spoofing using punycode in URLs and certificates