What is Path Equivalence (CWE-45)?

TL;DR: Path Equivalence (CWE-45) occurs when a product accepts path input in the form of multiple internal dot without appropriate validation, leading to ambiguous path resolution and allowing an attacker to traverse the file system to unintended locations or access arbitrary files. Implement robust remediations, such as validating path input, canonicalizing paths, using allowlists, and enforcing least privilege.

What is Path Equivalence?

Path Equivalence (CWE-45) is a type of vulnerability that occurs when a product accepts path input in the form of multiple internal dot without appropriate validation, leading to ambiguous path resolution and allowing an attacker to traverse the file system to unintended locations or access arbitrary files. As defined by the MITRE Corporation under CWE-45, and classified by the OWASP Foundation under None, Path Equivalence is a critical vulnerability that requires robust remediations.

Quick Summary

Path Equivalence (CWE-45) occurs when a product accepts path input in the form of multiple internal dot without appropriate validation, leading to ambiguous path resolution and allowing an attacker to traverse the file system to unintended locations or access arbitrary files. The consequences of Path Equivalence include read files or directories, modify files or directories, confidentiality breaches, integrity violations, and availability disruptions.

Jump to: Quick Summary · Path Equivalence Overview · How Path Equivalence Works · Business Impact of Path Equivalence · Path Equivalence Attack Scenario · How to Detect Path Equivalence · How to Fix Path Equivalence · Framework-Specific Fixes for Path Equivalence · How to Ask AI to Check Your Code for Path Equivalence · Path Equivalence Best Practices Checklist · Path Equivalence FAQ · Vulnerabilities Related to Path Equivalence · References · Scan Your Own Site

Path Equivalence Overview

What: Path Equivalence (CWE-45) occurs when a product accepts path input in the form of multiple internal dot without appropriate validation, leading to ambiguous path resolution and allowing an attacker to traverse the file system to unintended locations or access arbitrary files.

Why it matters: The consequences of Path Equivalence include read files or directories, modify files or directories, confidentiality breaches, integrity violations, and availability disruptions.

Where it occurs: Path Equivalence can occur in any product that accepts path input without proper validation.

Who is affected: Any user who interacts with the affected product may be vulnerable to Path Equivalence attacks.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by Path Equivalence.

How Path Equivalence Works

Root Cause

Path Equivalence occurs when a product accepts path input in the form of multiple internal dot without appropriate validation, leading to ambiguous path resolution and allowing an attacker to traverse the file system to unintended locations or access arbitrary files.

Attack Flow

1. An attacker manipulates path input to reach unintended locations or access arbitrary files.
2. The product accepts the manipulated path input without proper validation.
3. The product resolves the path to an unintended location, allowing the attacker to access sensitive data or modify files.

Prerequisites to Exploit

• Path input is accepted by the product without proper validation.
• The product resolves paths using a vulnerable algorithm (e.g., os.path.join()).

Vulnerable Code

import os

path = request.form['path']
os.chdir(path)

This code snippet demonstrates a vulnerable implementation of path resolution, where an attacker can manipulate the path variable to reach unintended locations.

Secure Code

import os

base_dir = '/home/user'
path = request.form['path']

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')
else:
    os.chdir(path)

This code snippet demonstrates a secure implementation of path resolution, where the path variable is validated before being used to change directories.

Business Impact of Path Equivalence

Confidentiality: The consequences of Path Equivalence include read files or directories, which can lead to confidentiality breaches.

Integrity: The consequences of Path Equivalence include modify files or directories, which can lead to integrity violations.

Availability: The consequences of Path Equivalence include availability disruptions, as attackers may be able to access sensitive data or modify critical system files.

The business impact of Path Equivalence includes financial losses due to data breaches, compliance issues, and reputation damage.

Path Equivalence Attack Scenario

1. An attacker discovers a vulnerable product that accepts path input without proper validation.
2. The attacker manipulates the path input to reach an unintended location or access arbitrary files.
3. The product resolves the path to the unintended location, allowing the attacker to access sensitive data or modify critical system files.

How to Detect Path Equivalence

Manual Testing

• Identify products that accept path input without proper validation.
• Analyze code for vulnerable path resolution algorithms (e.g., os.path.join()).
• Test products with manipulated path inputs to identify vulnerabilities.

Automated Scanners (SAST / DAST)

Static analysis tools can detect Path Equivalence vulnerabilities by analyzing code for vulnerable path resolution algorithms. Dynamic testing tools can identify vulnerabilities by manipulating path inputs and observing the product’s behavior.

PenScan Detection

PenScan’s scanner engines actively test for Path Equivalence vulnerabilities by identifying products that accept path input without proper validation and analyzing code for vulnerable path resolution algorithms.

False Positive Guidance

To avoid false positives, consider the following:

• Products with robust path validation mechanisms are less likely to be vulnerable.
• Manipulated path inputs may not always result in a vulnerability.

How to Fix Path Equivalence

Implement robust remediations, such as:

• Validating path input
• Canonicalizing paths
• Using allowlists
• Enforcing least privilege

Framework-Specific Fixes for Path Equivalence

Java

import java.io.File;

String path = request.getParameter('path');
File file = new File(path);
if (!file.getCanonicalPath().startsWith(baseDir)) {
    throw new SecurityException('Invalid path');
}

Node.js

const path = require('path');

let baseDir = '/home/user';
let pathInput = req.body.path;

if (!path.normalize(pathInput).startsWith(baseDir)) {
    return res.status(400).send('Invalid path');
}

Python/Django

import os

base_dir = '/home/user'
path_input = request.GET.get('path')

if not os.path.abspath(path_input).startswith(base_dir):
    raise ValueError('Invalid path')

How to Ask AI to Check Your Code for Path Equivalence

Review the following [language] code block for potential CWE-45 Path Equivalence vulnerabilities and rewrite it using canonicalization:

import os

path = request.form['path']
os.chdir(path)

Rewrite the code using canonicalization:

import os

base_dir = '/home/user'
path = request.form['path']

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')
else:
    os.chdir(path)

Path Equivalence Best Practices Checklist

✅ Validate path input ✅ Canonicalize paths ✅ Use allowlists ✅ Enforce least privilege

Path Equivalence FAQ

How does Path Equivalence occur?

Path Equivalence occurs when a product accepts path input in the form of multiple internal dot without appropriate validation, leading to ambiguous path resolution and allowing an attacker to traverse the file system to unintended locations or access arbitrary files.

What are the consequences of Path Equivalence?

The consequences of Path Equivalence include read files or directories, modify files or directories, confidentiality breaches, integrity violations, and availability disruptions.

How does an attacker exploit Path Equivalence?

An attacker exploits Path Equivalence by manipulating path input to reach unintended locations or access arbitrary files, which can lead to data breaches, system compromise, or denial of service.

What are the common consequences of Path Equivalence?

The common consequences of Path Equivalence include read files or directories and modify files or directories.

How does an attacker detect Path Equivalence vulnerabilities?

An attacker detects Path Equivalence vulnerabilities by analyzing code for path input validation, identifying potential entry points for malicious input, and exploiting the vulnerability to reach unintended locations or access arbitrary files.

What are the primary prevention techniques for Path Equivalence?

The primary prevention techniques for Path Equivalence include validating path input, canonicalizing paths, using allowlists, and enforcing least privilege.

How does an attacker fix Path Equivalence vulnerabilities?

An attacker fixes Path Equivalence vulnerabilities by implementing robust remediations, such as validating path input, canonicalizing paths, using allowlists, and enforcing least privilege.

Vulnerabilities Related to Path Equivalence

References

• MITRE CWE-45
• CAPEC None known
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Equivalence and other risks before an attacker does.