What is Path Equivalence (CWE-55)?

TL;DR: Path Equivalence (CWE-55) is a Security Misconfiguration vulnerability that occurs when a product accepts path input in the form of single dot directory exploit (‘/./’) without appropriate validation.

At-a-Glance

What is Path Equivalence?

Path Equivalence (CWE-55) is a type of Security Misconfiguration vulnerability that occurs when a product accepts path input in the form of single dot directory exploit (‘/./’) without appropriate validation, leading to ambiguous path resolution and potential file system traversal.

As defined by the MITRE Corporation under CWE-55, and classified by the OWASP Foundation under Not directly mapped…

Quick Summary

Path Equivalence (CWE-55) is a critical vulnerability that can lead to read files or directories, modify files or directories, and potentially allow an attacker to traverse the file system to unintended locations or access arbitrary files. To prevent Path Equivalence, ensure input validation and canonicalization of paths, use secure coding practices, and regularly review and update your codebase.

Jump to: Quick Summary · Path Equivalence Overview · How Path Equivalence Works · Business Impact of Path Equivalence · Path Equivalence Attack Scenario · How to Detect Path Equivalence · How to Fix Path Equivalence · Framework-Specific Fixes for Path Equivalence · How to Ask AI to Check Your Code for Path Equivalence · Path Equivalence Best Practices Checklist · Path Equivalence FAQ · Vulnerabilities Related to Path Equivalence · References · Scan Your Own Site

Path Equivalence Overview

What: Path Equivalence (CWE-55) is a type of Security Misconfiguration vulnerability that occurs when a product accepts path input in the form of single dot directory exploit (‘/./’) without appropriate validation.

Why it matters: Path Equivalence can lead to read files or directories, modify files or directories, and potentially allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Where it occurs: Path Equivalence typically occurs in web applications and web servers that accept user input in the form of path parameters.

Who is affected: Any product that accepts path input without proper validation can be vulnerable to Path Equivalence.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by Path Equivalence.

How Path Equivalence Works

Root Cause

The root cause of Path Equivalence is the lack of input validation and canonicalization of paths in a product. When a product accepts path input without proper validation, it can lead to ambiguous path resolution and potential file system traversal.

Attack Flow

1. An attacker sends a request with a malicious path parameter.
2. The product processes the request without proper validation, leading to ambiguous path resolution.
3. The attacker gains access to unintended locations or files.

Prerequisites to Exploit

• The product must accept user input in the form of path parameters.
• The product must lack proper input validation and canonicalization of paths.

Vulnerable Code

import os

path = request.args.get('path')
os.chdir(path)

The vulnerable code uses os.chdir() to change the current working directory based on the user-provided path. However, this code lacks proper input validation and canonicalization of paths, making it vulnerable to Path Equivalence.

Secure Code

import os

path = request.args.get('path')
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")
os.chdir(path)

The secure code uses os.path.abspath() to canonicalize the provided path and checks if it starts with a valid base directory. If the path is invalid, it raises an error.

Business Impact of Path Equivalence

Confidentiality: Path Equivalence can lead to read files or directories, potentially exposing sensitive information.

Integrity: Path Equivalence can modify files or directories, potentially allowing an attacker to modify critical system files.

Availability: Path Equivalence can disrupt file system traversal, potentially leading to downtime and data loss.

Real-world business consequences of Path Equivalence include:

• Financial losses due to data breaches
• Compliance issues due to regulatory non-compliance
• Reputation damage due to public disclosure of vulnerabilities

Path Equivalence Attack Scenario

1. An attacker sends a request with a malicious path parameter.
2. The product processes the request without proper validation, leading to ambiguous path resolution.
3. The attacker gains access to unintended locations or files.

How to Detect Path Equivalence

Manual Testing

• Review code for potential path traversal vulnerabilities
• Test for ambiguous path resolution
• Verify input validation and canonicalization of paths

Automated Scanners (SAST / DAST)

Static analysis can detect potential path traversal vulnerabilities, but dynamic testing is required to confirm the vulnerability.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

False positives may occur when a product has proper input validation and canonicalization of paths. To avoid false positives, ensure that scanners are configured correctly and review code manually.

How to Fix Path Equivalence

• Ensure input validation and canonicalization of paths
• Use secure coding practices
• Regularly review and update your codebase

Framework-Specific Fixes for Path Equivalence

Java

import java.io.File;

String path = request.getParameter("path");
if (!new File(path).isAbsolute()) {
    throw new RuntimeException("Invalid path");
}

The secure code uses File.isAbsolute() to check if the provided path is absolute.

Node.js

const path = require('path');

let filePath = req.params.path;
filePath = path.normalize(filePath);
if (!filePath.startsWith(baseDir)) {
  return res.status(400).send({ message: 'Invalid path' });
}

The secure code uses path.normalize() to canonicalize the provided path and checks if it starts with a valid base directory.

Python/Django

import os

path = request.GET.get('path')
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")

The secure code uses os.path.abspath() to canonicalize the provided path and checks if it starts with a valid base directory.

PHP

$path = $_GET['path'];
if (!is_absolute_path($path)) {
    throw new RuntimeException('Invalid path');
}

The secure code uses is_absolute_path() to check if the provided path is absolute.

How to Ask AI to Check Your Code for Path Equivalence

You can ask an AI coding assistant to review your code for potential CWE-55 vulnerabilities and rewrite it using primary fix techniques. Here’s a copy-pasteable prompt:

Review the following [language] code block for potential CWE-55 Path Equivalence vulnerabilities and rewrite it using input validation and canonicalization of paths: [paste code here]

Copy-paste prompt

Path Equivalence Best Practices Checklist

✅ Ensure input validation and canonicalization of paths ✅ Use secure coding practices ✅ Regularly review and update your codebase

Path Equivalence FAQ

How does Path Equivalence occur?

Path Equivalence occurs when a product accepts path input in the form of single dot directory exploit (‘/./’) without appropriate validation, leading to ambiguous path resolution and potential file system traversal.

What are the consequences of Path Equivalence?

The consequences of Path Equivalence include read files or directories, modify files or directories, and potentially allow an attacker to traverse the file system to unintended locations or access arbitrary files.

How can I detect Path Equivalence in my code?

You can detect Path Equivalence by manually testing for path traversal vulnerabilities, using automated scanners (SAST / DAST), or PenScan’s detection capabilities.

What are the best practices to prevent Path Equivalence?

To prevent Path Equivalence, ensure input validation and canonicalization of paths, use secure coding practices, and regularly review and update your codebase.

Can AI assist in detecting and fixing Path Equivalence vulnerabilities?

Yes, AI can help detect and fix Path Equivalence vulnerabilities by reviewing code for potential CWE-55 vulnerabilities and rewriting it using primary fix techniques.

What are the related weaknesses to Path Equivalence?

The related weakness to Path Equivalence is Improper Resolution of Path Equivalence (CWE-41), which is a more specific variant of Path Equivalence.

How can I protect my website from Path Equivalence attacks?

You can protect your website by implementing secure coding practices, ensuring input validation and canonicalization of paths, and regularly reviewing and updating your codebase.

Vulnerabilities Related to Path Equivalence

References

• MITRE: CWE-55
• CAPEC: None known
• NVD: CWE-55

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Equivalence and other risks before an attacker does.