DEV Community

Justin Begley
Justin Begley

Posted on

Path Traversal

#hacking

What is path traversal??

Path traversal is also know as directory traversal. These vulnerabilities enable an attacker to read arbitrary files on the server that is running an application. This might include:

  • Application code and data
  • Credentials for back-end systems
  • sensitive operating system files

In some cases, an attacker might be able to write to arbitrary files on the server, allowing them to modify application data or behavior, and ultimately take full control of the server.

Reading arbitrary files via path traversal

Imagine a shopping application that displays images of items for sale. This might might load an image using the following HTML:

<img src="/loadImage?filename=218.png">
Enter fullscreen mode Exit fullscreen mode

The loadImage URL takes a filename parameter and return the contents of the specified file. The image files are stored on disk in the location /var/www/images . To return an image, the application appends the requested filename to this base directory and uses a filesystem API to read the contents of the file. In other words , the application reads from the following path:

/var/www/images/218.png
Enter fullscreen mode Exit fullscreen mode

This application implements no defenses against path traversal attacks. As a result, an attacker can request the following URL to retrieve the /etc/passwd file from the server’s filesystem:

https://insecure-website.com/loadImage?filename=../../../etc/passwd
Enter fullscreen mode Exit fullscreen mode

This causes the application to read from the following path:

/var/www/images/../../../etc/passwd
Enter fullscreen mode Exit fullscreen mode

The sequence ../ is valid within a file path, and means to step up one level in the directory structure. The three consecutive ../ sequences step up from /var/www/images/ to the filesystem root, and so the file that is actually read is:

/etc/passwd
Enter fullscreen mode Exit fullscreen mode

On unix-based operating systems, this is a standard file containing details of the users that are registered on the server, but an attacker could retrieve other arbitrary files using the same technique.

On Windows, both ../ and ..\ are valid directory traversal sequences. The following is an example of an equivalent attack against a Windows-based server:

https://insecure-website.com/loadImage?=filename=..\..\..\windows\win.ini
Enter fullscreen mode Exit fullscreen mode

Common obstacles to exploiting path traversal vulnerabilities

Many applications that place user input into file paths implement defenses against path traversal attacks. These can often be bypassed.

If an application strips or blocks directory traversal sequences from the user supplied filename, it might be possible to bypass the defense using a variety of techniques.

You might be able to use an absolute path from from the filesystem root, such as filename=/etc/passwd , to directly reference a file without using any traversal sequences.

You might be able to use nested traversal sequenced, such as ....// or ....\/ . These revert to simple traversal sequences when the inner sequence is stripped.

In some contexts, such as in a URL path or the filename parameter of a multipart/form-data request, web servers may strip any directory traversal sequences before passing your input to the application. You can sometimes bypass this kind of sanitization by URL encoding, or even double URL encoding, the ../ characters. This results in %2e%2e%2f and %252e%252e%252f. Various non-standard encodings such as ..%c0%af or ..%ef%bc%8f may also work.

An application may require the user-supplied filename to start with the expected base folder such as /var/www/images. In this case, it might be possible to include the required base folder followed nu suitable traversal sequences. For example:

filename=/var/www/images/../../../etc/passwd
Enter fullscreen mode Exit fullscreen mode

An application may require the user-supplied filename to end with an expected file extension, such as .png. in this case it might be possible to use a null byte to effectively terminate the file path before the required extension. For example:

filename=../../../etc/passwd%00.png
Enter fullscreen mode Exit fullscreen mode

How to prevent a path traversal attack

The most effective way to prevent path traversal vulnerabilities is to avoid passing user supplied input to filesystem APIs altogether. Many application functions that do this can be rewritten to deliver the same behavior in a safe way.

Top comments (0)