DEV Community

Cover image for The Website Was Supposed to Show Images. It Started Showing Server Files.
Arashad Dodhiya
Arashad Dodhiya

Posted on

The Website Was Supposed to Show Images. It Started Showing Server Files.

#cybersecurity #devops #backend #software

Imagine you're building a simple website.

The website stores images like:

/images/logo.png
/images/banner.png
/images/profile.jpg
Enter fullscreen mode Exit fullscreen mode

When a user requests:

https://example.com/images/logo.png
Enter fullscreen mode Exit fullscreen mode

The server returns:

logo.png
Enter fullscreen mode Exit fullscreen mode

Everything works perfectly.

But what if a user could somehow leave the images folder and start browsing other parts of the server?

That's the idea behind one of the most important web security concepts:

Path Traversal.

And it's exactly the kind of mistake that affected Apache HTTPD in CVE-2021-41773.

Understanding Folders Like a House

Imagine your house looks like this:

House
│
├── Living Room
├── Kitchen
├── Bedroom
└── Garage
Enter fullscreen mode Exit fullscreen mode

Now suppose you invite someone into the living room.

You expect them to stay here:

House
│
└── Living Room
Enter fullscreen mode Exit fullscreen mode

But instead they start opening doors and walking through the entire house.

Suddenly they can see:

Kitchen
Bedroom
Garage
Documents
Personal Items
Enter fullscreen mode Exit fullscreen mode

That's essentially what Path Traversal is.

The application intended to give access to one location.

The user found a way to move somewhere else.

How Websites Access Files

Many websites allow users to request files.

For example:

/images/logo.png
Enter fullscreen mode Exit fullscreen mode

Internally the server may process:

website_folder/images/logo.png
Enter fullscreen mode Exit fullscreen mode

This is normal.

The server expects users to remain inside:

website_folder
Enter fullscreen mode Exit fullscreen mode

What Does Traversal Mean?

Traversal simply means:

Moving Through Directories
Enter fullscreen mode Exit fullscreen mode

Imagine:

website_folder
│
├── images
├── css
└── js
Enter fullscreen mode Exit fullscreen mode

Normally users access:

images/logo.png
Enter fullscreen mode Exit fullscreen mode

But operating systems provide special directory references.

For example:

..
Enter fullscreen mode Exit fullscreen mode

means:

Go Up One Folder
Enter fullscreen mode Exit fullscreen mode

Example:

images/..
Enter fullscreen mode Exit fullscreen mode

becomes:

website_folder
Enter fullscreen mode Exit fullscreen mode

A Simple Example

Suppose the application expects:

images/logo.png
Enter fullscreen mode Exit fullscreen mode

An attacker supplies:

../../../
Enter fullscreen mode Exit fullscreen mode

Conceptually:

Current Folder
     ↑
Parent Folder
     ↑
Parent Folder
     ↑
Parent Folder
Enter fullscreen mode Exit fullscreen mode

Now the request is no longer inside the web application.

It's exploring the server.

Why Is This Dangerous?

Because servers contain far more than website files.

Examples:

Configuration Files
Application Secrets
Passwords
API Keys
Database Credentials
System Information
Enter fullscreen mode Exit fullscreen mode

Suddenly a file viewer becomes a server explorer.

What Happened In Apache HTTPD?

Apache HTTP Server is one of the most widely used web servers.

Simplified architecture:

Browser
    ↓
Apache HTTPD
    ↓
Files
    ↓
Response
Enter fullscreen mode Exit fullscreen mode

A flaw in specific versions allowed attackers to use crafted paths to access files outside intended directories.

The important lesson isn't the exact syntax.

The important lesson is understanding what happens when access boundaries fail.

Why Developers Should Care

Many developers build features such as:

Document Downloads
Profile Images
Export Files
PDF Viewers
Media Libraries
Enter fullscreen mode Exit fullscreen mode

Whenever user input influences file paths, risk appears.

A useful question is:

Can a user influence which file gets opened?

If the answer is yes, further validation is needed.

Why DevOps Engineers Should Care

This vulnerability teaches an important infrastructure lesson.

Never Rely On A Single Layer

Many organizations assume:

Application Security
Enter fullscreen mode Exit fullscreen mode

will protect everything.

But infrastructure should also help.

Examples:

File Permissions
Container Isolation
Least Privilege
Network Segmentation
Enter fullscreen mode Exit fullscreen mode

If one layer fails, another layer should reduce impact.

Understanding Sensitive Files

Many beginners hear "sensitive file" and think:

Passwords.txt
Enter fullscreen mode Exit fullscreen mode

Reality is much broader.

Examples include:

.env
config files
SSH keys
Database credentials
Cloud secrets
Private certificates
Enter fullscreen mode Exit fullscreen mode

Attackers often don't need direct server access.

Sometimes reading one configuration file is enough.

The Real Attack Chain

Path Traversal usually looks like:

User Input
     ↓
File Path
     ↓
Unexpected Directory Access
     ↓
Sensitive File Exposure
Enter fullscreen mode Exit fullscreen mode

Notice something important.

There is no malware.

There is no exploit code.

The application simply accesses the wrong file.

Common Mistakes

Trusting User Input

Many vulnerabilities begin here.

Users should never fully control file paths.

Assuming Hidden Means Secure

Just because users can't see a file doesn't mean they can't reach it.

Ignoring Infrastructure Controls

Applications fail.

Security layers should assume that.

What Makes This Vulnerability Valuable To Learn?

This single topic teaches:

Security 

Path Traversal
File Disclosure
Attack Surface
Enter fullscreen mode Exit fullscreen mode

Development 

Input Validation
File Handling
Secure Design
Enter fullscreen mode Exit fullscreen mode

DevOps 

Permissions
Isolation
Defense In Depth
Enter fullscreen mode Exit fullscreen mode

Architecture 

Trust Boundaries
System Design
Layered Security
Enter fullscreen mode Exit fullscreen mode

Few vulnerability classes provide lessons across so many disciplines.

Key Takeaways

  • Path Traversal occurs when users access files outside intended directories.
  • Web applications frequently interact with files and folders.
  • User-controlled paths create risk.
  • Sensitive files often contain secrets rather than obvious passwords.
  • Apache HTTPD demonstrated how boundary failures can expose server data.
  • Developers should validate file paths carefully.
  • DevOps teams should implement defense-in-depth controls.
  • Security is strongest when applications and infrastructure work together.

Final Thoughts

The Apache HTTPD Path Traversal vulnerability wasn't just a web server bug.

It was a reminder of a fundamental security principle:

Every file you can reach is part of your attack surface.

A website may look like a collection of pages.

A developer may see routes and features.

A DevOps engineer may see servers and containers.

An attacker often sees something simpler:

A path.

And wonders where it leads.

Top comments (1)

Collapse
 
arashad_dodhiya_0e4bdba5a profile image
Arashad Dodhiya •

If a website accidentally exposed one file from your infrastructure, which file would concern you the most?🤔