What is Path Equivalence (CWE-54)?

TL;DR: “Path Equivalence (CWE-54) occurs when a product accepts path input in the form of trailing backslash (‘filedir\’) without appropriate validation, leading to ambiguous path resolution and potential file system traversal. To fix it, you should input validation, canonicalization of inputs, and making sure that the application does not decode the same input twice.”

At-a-Glance

What is Path Equivalence?

Path Equivalence (CWE-54) is a type of Security Misconfiguration vulnerability that occurs when a product accepts path input in the form of trailing backslash (‘filedir\’) without appropriate validation, leading to ambiguous path resolution and potential file system traversal. As defined by the MITRE Corporation under CWE-54.

Quick Summary

Path Equivalence (CWE-54) is a critical security vulnerability that can lead to business impact on confidentiality, integrity, and availability. It occurs when a product accepts path input in the form of trailing backslash (‘filedir\’) without appropriate validation. To fix it, you should input validation, canonicalization of inputs, and making sure that the application does not decode the same input twice.

Jump to: Quick Summary · Path Equivalence Overview · How Path Equivalence Works · Business Impact of Path Equivalence · Path Equivalence Attack Scenario · How to Detect Path Equivalence · How to Fix Path Equivalence · Framework-Specific Fixes for Path Equivalence · How to Ask AI to Check Your Code for Path Equivalence · Path Equivalence Best Practices Checklist · Path Equivalence FAQ · Vulnerabilities Related to Path Equivalence · References · Scan Your Own Site

Path Equivalence Overview

What: Path Equivalence (CWE-54) is a type of Security Misconfiguration vulnerability that occurs when a product accepts path input in the form of trailing backslash (‘filedir\’) without appropriate validation, leading to ambiguous path resolution and potential file system traversal.

Why it matters: The consequences of Path Equivalence include read files or directories, modify files or directories, and potentially lead to business impact on confidentiality, integrity, and availability.

Where it occurs: Path Equivalence can occur in web applications that accept user input in the form of path names.

Who is affected: Web application developers and users who interact with web applications that are vulnerable to Path Equivalence.

Who is NOT affected: Systems that do not accept user input in the form of path names, such as those using a fixed file system configuration.

How Path Equivalence Works

Root Cause

The root cause of Path Equivalence (CWE-54) is the lack of proper validation and canonicalization of path inputs. This allows an attacker to manipulate the path resolution and potentially traverse the file system to unintended locations or access arbitrary files.

Attack Flow

1. An attacker sends a malicious request with a trailing backslash (‘filedir\’) in the path input.
2. The application does not properly validate and canonicalize the path input, leading to ambiguous path resolution.
3. The attacker can potentially traverse the file system to unintended locations or access arbitrary files.

Prerequisites to Exploit

• The application must accept user input in the form of path names.
• The application must not properly validate and canonicalize the path input.

Vulnerable Code

import os

path = request.form['path']
os.chdir(path)

This code is vulnerable because it does not properly validate and canonicalize the path input. An attacker can manipulate the path resolution by sending a malicious request with a trailing backslash (‘filedir\’) in the path input.

Secure Code

import os

path = request.form['path']
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")
os.chdir(path)

This code is secure because it properly validates and canonicalizes the path input using os.path.abspath() and checks if the path starts with a valid base directory.

Business Impact of Path Equivalence

Confidentiality: Path Equivalence can lead to unauthorized access to sensitive files or directories, potentially compromising confidentiality.

Integrity: Path Equivalence can allow an attacker to modify files or directories, potentially compromising integrity.

Availability: Path Equivalence can disrupt the availability of web applications by allowing an attacker to traverse the file system and access arbitrary files.

Path Equivalence Attack Scenario

1. An attacker sends a malicious request with a trailing backslash (‘filedir\’) in the path input.
2. The application does not properly validate and canonicalize the path input, leading to ambiguous path resolution.
3. The attacker can potentially traverse the file system to unintended locations or access arbitrary files.

How to Detect Path Equivalence

Manual Testing

• Review web application code for proper validation and canonicalization of path inputs.
• Test web applications with malicious requests containing trailing backslashes (‘filedir\’) in the path input.

Automated Scanners (SAST / DAST)

• Use automated scanners to identify potential vulnerabilities related to Path Equivalence.

PenScan Detection

• PenScan’s scanner engines actively test for this issue.

False Positive Guidance

• Be cautious when reviewing findings, as some patterns may look risky but are actually safe due to context that the scanner cannot see.

How to Fix Path Equivalence

• Input validation: Validate user input in the form of path names.
• Canonicalization: Canonicalize path inputs using os.path.abspath() or similar methods.
• Avoid decoding the same input twice: Ensure that the application does not decode the same input twice, which can lead to ambiguous path resolution.

Framework-Specific Fixes for Path Equivalence

Java

import java.io.File;

String path = request.getParameter("path");
File file = new File(path);
if (!file.getAbsoluteFile().startsWith(baseDir)) {
    throw new RuntimeException("Invalid path");
}

Node.js

const path = require('path');

let inputPath = req.body.path;
inputPath = path.normalize(inputPath);
if (inputPath.startsWith(baseDir)) {
    // Valid path
} else {
    // Invalid path
}

Python/Django

import os

path = request.POST['path']
path = os.path.abspath(path)
if not path.startswith(base_dir):
    raise ValueError("Invalid path")

PHP

$path = $_POST['path'];
$path = realpath($path);
if (strpos($path, $baseDir) === 0) {
    // Valid path
} else {
    // Invalid path
}

How to Ask AI to Check Your Code for Path Equivalence

You can use the following prompt with an AI coding assistant:

“Review the following [language] code block for potential CWE-54 Path Equivalence vulnerabilities and rewrite it using canonicalization of inputs: [paste code here].”

Copy-paste prompt

Path Equivalence Best Practices Checklist

✅ Validate user input in the form of path names. ✅ Canonicalize path inputs using os.path.abspath() or similar methods. ✅ Avoid decoding the same input twice.

Path Equivalence FAQ

How does Path Equivalence occur?

Path Equivalence occurs when a product accepts path input in the form of trailing backslash (‘filedir\’) without appropriate validation, leading to ambiguous path resolution and potential file system traversal.

What are the consequences of Path Equivalence?

The consequences of Path Equivalence include read files or directories, modify files or directories, and potentially lead to business impact on confidentiality, integrity, and availability.

How can I detect Path Equivalence in my application?

You can detect Path Equivalence by using manual testing, automated scanners (SAST / DAST), and PenScan detection.

What are the best practices for preventing Path Equivalence?

The best practices for preventing Path Equivalence include input validation, canonicalization of inputs, and making sure that the application does not decode the same input twice.

Can AI help me detect and prevent Path Equivalence in my code?

Yes, AI can assist you in detecting and preventing Path Equivalence by reviewing your code for potential vulnerabilities and rewriting it using secure techniques.

What are some common mistakes to avoid when fixing Path Equivalence?

Common mistakes to avoid when fixing Path Equivalence include not validating user input, not canonicalizing inputs, and not making sure that the application does not decode the same input twice.

How can I ensure that my application is secure against Path Equivalence attacks?

You can ensure that your application is secure against Path Equivalence attacks by following best practices for input validation, canonicalization, and making sure that the application does not decode the same input twice.

Vulnerabilities Related to Path Equivalence

References

• MITRE: CWE-54
• CAPEC: None known
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Equivalence and other risks before an attacker does.