Path Traversal

Path traversal, also known as directory traversal, is a vulnerability that allows an attacker to access arbitrary files on a server running an application. This could include sensitive data like application code, credentials for back-end systems, or operating system files. In some cases, an attacker may even gain the ability to modify application data or behavior, potentially taking full control of the server.

To exploit these vulnerabilities, an attacker must manipulate a file path to access unintended files. For example, consider a shopping application that displays item images. The application uses an HTML image tag, such as `<img src="/loadImage?filename=218.png">`. The loadImage URL takes a filename parameter, which the application appends to a base directory, `/var/www/images/`, and reads the file's contents using a filesystem API.

Without any defenses against path traversal, an attacker could manipulate the filename parameter to retrieve unauthorized files. For instance, the URL `<https://insecure-website.com/loadImage?filename=../../../etc/passwd>` would cause the application to read the `/etc/passwd` file from the server's filesystem. This file typically contains user account information, but an attacker could retrieve any other file using the same method. On Windows-based servers, the attack would use `..\` instead of `../`.

There are several ways to bypass defenses against path traversal attacks. One method involves using nested traversal sequences like `../` or `...`. These sequences may be stripped by the application, but can be reinserted using URL encoding or double URL encoding. For example, the URL `https://insecure-website.com/loadImage?filename=%252e%252e%252e%2fwindows%2fwin.ini` could be used to retrieve the `win.ini` file from the Windows system.

To prevent path traversal vulnerabilities, avoid passing user-supplied input to filesystem APIs entirely. Instead, rewrite application functions to achieve the same functionality in a safe manner.