What is Path Equivalence (CWE-50)?

TL;DR: “Path Equivalence (CWE-50) is a Sensitive Data Protection vulnerability that occurs when a product accepts path input without validation, allowing an attacker to access arbitrary files.”

What is Path Equivalence?

Path Equivalence (CWE-50) is a type of Sensitive Data Protection vulnerability that occurs when a product accepts path input in the form of multiple leading slash (‘//multiple/leading/slash’) without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files. As defined by the MITRE Corporation under CWE-50, and classified by the OWASP Foundation under A3:2021 - Sensitive Data Protection…

Quick Summary

Path Equivalence (CWE-50) is a type of Sensitive Data Protection vulnerability that occurs when a product accepts path input without validation. This can lead to confidentiality and integrity breaches, including Read Files or Directories and Modify Files or Directories.

Jump to: Quick Summary · Path Equivalence Overview · How Path Equivalence Works · Business Impact of Path Equivalence · Path Equivalence Attack Scenario · How to Detect Path Equivalence · How to Fix Path Equivalence · Framework-Specific Fixes for Path Equivalence · How to Ask AI to Check Your Code for Path Equivalence · Path Equivalence Best Practices Checklist · Path Equivalence FAQ · Vulnerabilities Related to Path Equivalence · References · Scan Your Own Site

Path Equivalence Overview

• What: Path Equivalence (CWE-50) occurs when a product accepts path input in the form of multiple leading slash (‘//multiple/leading/slash’) without appropriate validation.
• Why it matters: The consequences of Path Equivalence include Read Files or Directories and Modify Files or Directories, which can lead to confidentiality and integrity breaches.
• Where it occurs: Path Equivalence can occur in web frameworks, web applications, and file systems.
• Who is affected: Any product that accepts path input without validation is at risk of Path Equivalence.
• Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected.

How Path Equivalence Works

Root Cause

Path Equivalence occurs when a product fails to validate path input, allowing an attacker to traverse the file system to unintended locations or access arbitrary files.

Attack Flow

1. An attacker submits path input in the form of multiple leading slash (‘//multiple/leading/slash’) to a vulnerable product.
2. The product accepts the path input without validation, allowing the attacker to access arbitrary files.
3. The attacker can then modify or read sensitive data, leading to confidentiality and integrity breaches.

Prerequisites to Exploit

• Path input must be submitted in the form of multiple leading slash (‘//multiple/leading/slash’).
• The product must accept path input without validation.

Vulnerable Code

import os

def serve_static(path):
    full_path = os.path.join(STATIC_ROOT, path)
    with open(full_path) as f:
        return f.read()

path comes from the request and is joined onto STATIC_ROOT with no check. Python’s os.path.join() discards everything before a component that itself starts with / — a value like //etc/passwd is treated as an absolute path, so the join silently resets and ignores STATIC_ROOT entirely, serving the attacker’s chosen file instead.

Secure Code

import os

def serve_static(path):
    full_path = os.path.normpath(os.path.join(STATIC_ROOT, path.lstrip('/')))
    if not full_path.startswith(STATIC_ROOT):
        raise ValueError('invalid path')
    with open(full_path) as f:
        return f.read()

Stripping leading slashes from path before joining prevents it from being treated as an absolute path that resets the join, and the follow-up prefix check on the normalized result catches any other equivalence trick that would otherwise land outside STATIC_ROOT.

Business Impact of Path Equivalence

• Confidentiality: Path Equivalence can lead to confidentiality breaches, including Read Files or Directories.
• Integrity: Path Equivalence can also lead to integrity breaches, including Modify Files or Directories.
• Availability: In some cases, Path Equivalence can also lead to availability breaches, including Denial of Service (DoS).

The business impacts of Path Equivalence include financial losses due to data breaches, compliance issues, and reputational damage.

Path Equivalence Attack Scenario

1. An attacker submits path input in the form of multiple leading slash (‘//multiple/leading/slash’) to a vulnerable product.
2. The product accepts the path input without validation, allowing the attacker to access arbitrary files.
3. The attacker can then modify or read sensitive data, leading to confidentiality and integrity breaches.

How to Detect Path Equivalence

Manual Testing

• Check for path input validation in all products that accept path input.
• Verify that only authorized paths are accessed.

Automated Scanners (SAST / DAST)

Automated scanners can detect suspicious path patterns, but may not catch all instances of Path Equivalence. Dynamic testing is also required to ensure that the product behaves correctly under different inputs.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

False positives may occur when a legitimate path pattern looks risky due to context. Verify that the detected vulnerability is not a false alarm by checking the surrounding code and configuration.

How to Fix Path Equivalence

• Validate path input to prevent ambiguity and ensure that only authorized paths are accessed.
• Use canonicalization to normalize path inputs and prevent ambiguity.
• Ensure that all products that accept path input validate it correctly.

Framework-Specific Fixes for Path Equivalence

Python/Django

import os

base_dir = "/allowed/base/directory"

def validate_path(path):
    if not os.path.abspath(path).startswith(base_dir):
        raise ValueError("Invalid path")

path = "//multiple/leading/slash"
validate_path(path)

Java

import java.io.File;

public class PathValidator {
    public static void validatePath(String path) {
        File file = new File(path);
        if (!file.getAbsolutePath().startsWith("/allowed/base/directory")) {
            throw new IllegalArgumentException("Invalid path");
        }
    }

    public static void main(String[] args) {
        String path = "//multiple/leading/slash";
        validatePath(path);
    }
}

How to Ask AI to Check Your Code for Path Equivalence

Review the following [Python] code block for potential CWE-50 Path Equivalence vulnerabilities and rewrite it using canonicalization:

import os

path = "//multiple/leading/slash"
os.chdir(path)

Rewrite it as:

import os

base_dir = "/allowed/base/directory"

def validate_path(path):
    if not os.path.abspath(path).startswith(base_dir):
        raise ValueError("Invalid path")

path = "//multiple/leading/slash"
validate_path(path)

Path Equivalence Best Practices Checklist

✅ Validate all path inputs to prevent ambiguity and ensure that only authorized paths are accessed. ✅ Use canonicalization to normalize path inputs and prevent ambiguity. ✅ Ensure that all products that accept path input validate it correctly.

Path Equivalence FAQ

How is Path Equivalence defined?

Path Equivalence (CWE-50) is a type of Sensitive Data Protection vulnerability that occurs when a product accepts path input in the form of multiple leading slash (‘//multiple/leading/slash’) without appropriate validation.

What are the consequences of Path Equivalence?

The consequences of Path Equivalence include Read Files or Directories and Modify Files or Directories, which can lead to confidentiality and integrity breaches.

How does Path Equivalence work?

Path Equivalence occurs when a product fails to validate path input, allowing an attacker to traverse the file system to unintended locations or access arbitrary files.

What are the business impacts of Path Equivalence?

The business impacts of Path Equivalence include financial losses due to data breaches, compliance issues, and reputational damage.

How can I detect Path Equivalence in my code?

You can detect Path Equivalence using manual testing by checking for path input validation, or using automated scanners that check for suspicious path patterns.

How do I fix Path Equivalence in my code?

To fix Path Equivalence, you should validate path input to prevent ambiguity and ensure that only authorized paths are accessed.

What are the related vulnerabilities to Path Equivalence?

The related vulnerabilities to Path Equivalence include CWE-41: Improper Resolution of Path Equivalence and CWE-161: Improper Neutralization of Multiple Leading Special Elements.

Vulnerabilities Related to Path Equivalence

References

• MITRE CWE-50
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Equivalence and other risks before an attacker does.