# Canonicalization strips security metadata

Path rewrite or canonicalization that drops zone identifier, extension, or safe-file verdict before a check

_Area: Memory corruption and native code. Seen in 4 disclosed reports; one confirmed bounty: $2,500; latest 2024-08-06. Updated 2026-10-23._

## How it works
A security decision depends on metadata attached to a file or path: a Mark-of-the-Web zone stream, a file extension, or a safe-file verdict. Before that decision runs, some other component rewrites or reinterprets the path — canonicalizing it, truncating it, prefix-matching it, or handing it to the OS launcher. The rewrite silently changes which file is actually opened or which metadata survives, so the check evaluates a different object than the one that executes. The broken assumption is that the path seen by the checker is the path the OS will act on.

## Where it shows up
- Prefix or substring matching (`startswith`, `..`/name blocklists) used to decide what gets extracted or downloaded [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-38831.md)[E3](https://bugbountylibrary.com/r/h1%3A508894.md)
- A path passed to ShellExecute/ShellExecuteEx without normalization, especially with trailing spaces or dots [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-38831.md)[E4](https://bugbountylibrary.com/r/h1%3A544096.md)
- Fixed-size buffers just under a platform limit (256 vs MAX_PATH 260) where truncation can rewrite the extension [E4](https://bugbountylibrary.com/r/h1%3A544096.md)
- Components that rewrite files on disk (e.g. explorer.exe `_SaveAsLink()`) before a MotW/SmartScreen check runs [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dismantling-smart-app-control.md)
- Two code paths for one operation (netchan vs HTTP fast-download) where only one invokes the strong validator [E3](https://bugbountylibrary.com/r/h1%3A508894.md)

## How to review
Trace the exact path or file object from input to the security check and to the eventual OS call; confirm they are the same normalized object. The invariant: any metadata a check relies on (zone stream, extension, verdict) must be evaluated on the final canonical path the OS will execute, and validation must be exact-match, not prefix/substring. Diff parallel code paths and confirm both call the same validator [E3](https://bugbountylibrary.com/r/h1%3A508894.md). Check buffer sizes against platform path limits [E4](https://bugbountylibrary.com/r/h1%3A544096.md).

## Variants seen
- Prefix-match extraction pulls in a same-named directory, then default-extension search runs attacker file [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-38831.md)
- Canonicalization rewrite drops Zone.Identifier before SmartScreen/SAC [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dismantling-smart-app-control.md)
- HTTP download path skips the safe-file check the netchan path enforces [E3](https://bugbountylibrary.com/r/h1%3A508894.md)
- Path truncation swaps the extension to an executable-associated type [E4](https://bugbountylibrary.com/r/h1%3A544096.md)

## Impact and severity
Led to remote or silent code execution in all four reports, typically requiring a user action (double-click, preview, connect to server). Severity is high because the bypass defeats the intended trust boundary (MotW, safe-file filter, extension allowlist). Worse when no user prompt remains after the rewrite [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dismantling-smart-app-control.md) or when the payload persists and loads on next start [E3](https://bugbountylibrary.com/r/h1%3A508894.md).

## Evidence
- E1: https://bugbountylibrary.com/r/p0%3ACVE-2023-38831.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dismantling-smart-app-control.md
- E3: https://bugbountylibrary.com/r/h1%3A508894.md
- E4: https://bugbountylibrary.com/r/h1%3A544096.md