What is Path Traversal (CWE-25)?

AI-friendly summary

AI-friendly summary

TL;DR: Path Traversal (CWE-25) occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘/../’ sequences. The primary prevention technique for Path Traversal is input validation.

At-a-Glance

What is Path Traversal?

Path Traversal (CWE-25) is a type of CWE vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘/../’ sequences. As defined by the MITRE Corporation under CWE-25, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Path Traversal is a critical vulnerability that can lead to unauthorized access and data exposure. It occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘/../’ sequences. The primary prevention technique for Path Traversal is input validation.

Jump to: At-a-Glance · What is Path Traversal? · Quick Summary · Path Traversal Overview · How Path Traversal Works · Business Impact of Path Traversal · Path Traversal Attack Scenario · How to Detect Path Traversal · How to Fix Path Traversal · Framework-Specific Fixes for Path Traversal · How to Ask AI to Check Your Code for Path Traversal · Path Traversal Best Practices Checklist · Path Traversal FAQ · Vulnerabilities Related to Path Traversal · References · Scan Your Own Site

Path Traversal Overview

What

Path Traversal is a CWE vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘/../’ sequences.

Why it matters

A successful Path Traversal attack can lead to unauthorized access and data exposure, compromising confidentiality and integrity.

Where it occurs

Path Traversal can occur in any application that uses external input to construct pathnames, including web applications, file systems, and operating systems.

Who is affected

Any user who provides external input to an application that does not properly validate or sanitize the input may be vulnerable to Path Traversal attacks.

Who is NOT affected

Applications that never construct paths/queries/commands from external input are not affected by Path Traversal vulnerabilities.

How Path Traversal Works

Root Cause

The root cause of a Path Traversal vulnerability is the failure to properly neutralize ‘/../’ sequences in external input used to construct pathnames.

Attack Flow

1. An attacker provides external input to an application, which is used to construct a pathname.
2. The application does not properly validate or sanitize the input, allowing the attacker to inject ‘/../’ sequences.
3. The injected ‘/../’ sequences are used to navigate outside of the restricted directory, allowing the attacker to access unauthorized data.

Prerequisites to Exploit

• External input is provided to an application that uses it to construct pathnames.
• The application does not properly validate or sanitize the input.
• The attacker has knowledge of the application’s directory structure and can inject ‘/../’ sequences.

Vulnerable Code

import os

path = request.args.get('path')
os.chdir(path)

This code is vulnerable to Path Traversal attacks because it uses external input to construct a pathname without properly validating or sanitizing the input. The attacker can inject ‘/../’ sequences in the path variable, allowing them to navigate outside of the restricted directory.

Secure Code

import os

base_dir = '/restricted_directory'
path = request.args.get('path')

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')
else:
    os.chdir(path)

This code is secure because it properly validates and sanitizes the input by checking if the path variable starts with the base directory. If it does, the code proceeds to change the current working directory; otherwise, it raises a ValueError.

Business Impact of Path Traversal

Confidentiality

A successful Path Traversal attack can lead to unauthorized access and data exposure, compromising confidentiality.

• Data accessed: sensitive files and directories.
• Consequences: unauthorized disclosure of sensitive information.

Integrity

A successful Path Traversal attack can also compromise the integrity of an application’s data.

• Data modified: sensitive files and directories.
• Consequences: unauthorized modification or deletion of sensitive data.

Availability

In some cases, a successful Path Traversal attack may also disrupt the availability of an application.

• Data accessed: sensitive files and directories.
• Consequences: denial-of-service (DoS) attacks.

Path Traversal Attack Scenario

1. An attacker provides external input to an application, which is used to construct a pathname.
2. The application does not properly validate or sanitize the input, allowing the attacker to inject ‘/../’ sequences.
3. The injected ‘/../’ sequences are used to navigate outside of the restricted directory, allowing the attacker to access unauthorized data.

How to Detect Path Traversal

Manual Testing

• Review application code for potential CWE-25 vulnerabilities.
• Test application with external input to simulate a Path Traversal attack.
• Verify that the application properly validates and sanitizes input.

Automated Scanners (SAST / DAST)

PenScan’s automated scanner engines actively test for this issue, providing detailed reports on potential vulnerabilities. However, static analysis may not catch all instances of Path Traversal attacks, as some may require dynamic/runtime testing to detect.

PenScan Detection

PenScan’s scanner engines, including ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap, actively test for this issue.

False Positive Guidance

• Be cautious of false positives when using automated scanners, as some instances may be benign.
• Verify the findings with manual testing to ensure accuracy.

How to Fix Path Traversal

• Use input validation techniques to reject any input that does not strictly conform to specifications.
• Canonicalize inputs before validating them.
• Use stringent allowlists for filenames and only allow a single ‘.’ character in the filename.

Framework-Specific Fixes for Path Traversal

Java

import java.io.File;

public class PathTraversalFix {
    public static void changeDirectory(String path) {
        File file = new File(path);
        if (file.getAbsoluteFile().startsWith(baseDir)) {
            // Change directory safely
        } else {
            throw new SecurityException("Invalid path");
        }
    }
}

Node.js

const fs = require('fs');

function changeDirectory(path) {
    const baseDir = '/restricted_directory';
    if (path.startsWith(baseDir)) {
        // Change directory safely
    } else {
        throw new Error('Invalid path');
    }
}

Python/Django

import os

def change_directory(path):
    base_dir = '/restricted_directory'
    if not os.path.abspath(path).startswith(base_dir):
        raise ValueError('Invalid path')
    else:
        # Change directory safely

PHP

function changeDirectory($path) {
    $baseDir = '/restricted_directory';
    if (strpos($path, $baseDir) === 0) {
        // Change directory safely
    } else {
        throw new Exception('Invalid path');
    }
}

How to Ask AI to Check Your Code for Path Traversal

Review your code block for potential CWE-25 Path Traversal vulnerabilities and rewrite it using input validation techniques.

Path Traversal Best Practices Checklist

✅ Use input validation techniques to reject any input that does not strictly conform to specifications. ✅ Canonicalize inputs before validating them. ✅ Use stringent allowlists for filenames and only allow a single ‘.’ character in the filename.

Path Traversal FAQ

How does Path Traversal occur?

Path Traversal occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘/../’ sequences.

What are the consequences of a Path Traversal attack?

A successful Path Traversal attack can lead to unauthorized access and data exposure, compromising confidentiality and integrity.

How can I detect Path Traversal vulnerabilities in my application?

PenScan’s automated scanner engines actively test for this issue, providing detailed reports on potential vulnerabilities.

What is the primary prevention technique for Path Traversal?

The primary prevention technique for Path Traversal is input validation, which involves assuming all input is malicious and using an “accept known good” strategy to reject any input that does not strictly conform to specifications.

How can I fix Path Traversal vulnerabilities in my application?

To fix Path Traversal vulnerabilities, you should use stringent allowlists for filenames and only allow a single ‘.’ character in the filename. You should also use a list of allowable file extensions and canonicalize inputs before validating them.

What are some framework-specific fixes for Path Traversal?

Framework-specific fixes for Path Traversal include using ASP.NET’s Protected Configuration to remove sensitive data from web.config files, using Django’s SECRET_KEY setting to store secret keys securely, and using Node.js’s fs module with proper error handling.

How can I ask AI to check my code for Path Traversal vulnerabilities?

You can review your code block for potential CWE-25 Path Traversal vulnerabilities and rewrite it using input validation techniques.

What are some best practices for preventing Path Traversal attacks?

Some best practices for preventing Path Traversal attacks include using input validation, canonicalizing inputs, and using stringent allowlists for filenames.

Vulnerabilities Related to Path Traversal

References

• MITRE CWE-25
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Traversal and other risks before an attacker does.