What is Path Traversal (CWE-29)?

TL;DR: Path Traversal (CWE-29) occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences that can resolve to a location outside of that directory. To prevent this vulnerability, proper validation and sanitization of user input are essential.

At-a-Glance

What is Path Traversal?

Path Traversal (CWE-29) is a type of vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences that can resolve to a location outside of that directory. As defined by the MITRE Corporation under CWE-29, and classified by the OWASP Foundation as Not directly mapped.

Quick Summary

Path Traversal (CWE-29) is a critical vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences that can resolve to a location outside of that directory. This vulnerability can lead to confidentiality and integrity breaches, allowing attackers to read or modify files or directories outside of the intended restricted directory.

Jump to: What is Path Traversal? · Quick Summary · Path Traversal Overview · How Path Traversal Works · Business Impact of Path Traversal · Path Traversal Attack Scenario · How to Detect Path Traversal · How to Fix Path Traversal · Framework-Specific Fixes for Path Traversal · How to Ask AI to Check Your Code for Path Traversal · Path Traversal Best Practices Checklist · Path Traversal FAQ · Vulnerabilities Related to Path Traversal · References · Scan Your Own Site

Path Traversal Overview

What: Path Traversal (CWE-29) is a type of vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences that can resolve to a location outside of that directory.

Why it matters: Path Traversal vulnerabilities can lead to confidentiality and integrity breaches, allowing attackers to read or modify files or directories outside of the intended restricted directory.

Where it occurs: Path Traversal vulnerabilities can occur in various frameworks and platforms, including web applications built using Java, Python, Node.js, PHP, and others.

Who is affected: Any application that uses external input to construct a pathname that should be within a restricted directory is potentially vulnerable to Path Traversal attacks.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not vulnerable to Path Traversal attacks.

How Path Traversal Works

Root Cause

Path Traversal vulnerabilities occur when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences that can resolve to a location outside of that directory.

Attack Flow

1. An attacker provides malicious input to the application.
2. The application constructs a pathname using the malicious input.
3. The pathname resolves to a location outside of the intended restricted directory.
4. The attacker gains access to sensitive files or directories.

Prerequisites to Exploit

• The application must use external input to construct a pathname that should be within a restricted directory.
• The application must not properly neutralize sequences that can resolve to a location outside of that directory.

Vulnerable Code

import os

path = request.args.get('path')
os.chdir(path)

This code is vulnerable because it uses the request.args.get method to retrieve external input, which can contain malicious sequences. The os.chdir method then changes the current working directory to the specified path.

Secure Code

import os

base_dir = '/restricted_directory'
path = request.args.get('path')
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")
else:
    os.chdir(path)

This code is secure because it properly validates and sanitizes the external input using the os.path.abspath method. If the input path does not start with the base directory, a ValueError exception is raised.

Business Impact of Path Traversal

Confidentiality: Path Traversal vulnerabilities can lead to confidentiality breaches, allowing attackers to read sensitive files or directories outside of the intended restricted directory.

• Financial impact: Confidentiality breaches can result in financial losses due to data theft or unauthorized access.
• Compliance impact: Confidentiality breaches can result in non-compliance with regulatory requirements, such as GDPR or HIPAA.
• Reputation impact: Confidentiality breaches can damage an organization’s reputation and erode customer trust.

Integrity: Path Traversal vulnerabilities can lead to integrity breaches, allowing attackers to modify sensitive files or directories outside of the intended restricted directory.

• Financial impact: Integrity breaches can result in financial losses due to data tampering or unauthorized modifications.
• Compliance impact: Integrity breaches can result in non-compliance with regulatory requirements, such as GDPR or HIPAA.
• Reputation impact: Integrity breaches can damage an organization’s reputation and erode customer trust.

Availability: Path Traversal vulnerabilities can lead to availability breaches, allowing attackers to disrupt access to sensitive files or directories outside of the intended restricted directory.

• Financial impact: Availability breaches can result in financial losses due to downtime or data unavailability.
• Compliance impact: Availability breaches can result in non-compliance with regulatory requirements, such as GDPR or HIPAA.
• Reputation impact: Availability breaches can damage an organization’s reputation and erode customer trust.

Path Traversal Attack Scenario

1. An attacker provides malicious input to the application.
2. The application constructs a pathname using the malicious input.
3. The pathname resolves to a location outside of the intended restricted directory.
4. The attacker gains access to sensitive files or directories.

How to Detect Path Traversal

Manual Testing

• Use a web browser to test the application’s behavior with malicious input.
• Verify that the application constructs a pathname using the malicious input.
• Verify that the pathname resolves to a location outside of the intended restricted directory.

Automated Scanners (SAST / DAST)

• Use automated scanning tools, such as SAST or DAST, to detect Path Traversal vulnerabilities.
• These tools can identify potential vulnerabilities and provide recommendations for remediation.

PenScan Detection

• PenScan’s scanner engines actively test for this issue.
• PenScan provides detailed reports on detected vulnerabilities, including recommendations for remediation.

False Positive Guidance

• Be cautious when interpreting results from automated scanning tools or manual testing.
• Verify that the identified vulnerability is indeed a Path Traversal attack and not a false positive.

How to Fix Path Traversal

• Properly validate and sanitize external input using techniques such as canonicalization or whitelisting.
• Restrict directory traversal sequences, such as ‘..’ or ‘'.
• Ensure that file paths are properly canonicalized.

Framework-Specific Fixes for Path Traversal

Java

import java.io.File;

String path = request.getParameter("path");
File file = new File(path);
if (!file.getCanonicalPath().startsWith(baseDir)) {
    throw new SecurityException("Invalid path");
}

Node.js

const path = require('path');

let path = req.query.path;
let filePath = path.normalize(path);
if (!filePath.startsWith(baseDir)) {
    return res.status(400).send({ error: 'Invalid path' });
}

Python/Django

import os

path = request.GET.get('path')
file_path = os.path.abspath(path)
if not file_path.startswith(base_dir):
    raise ValueError("Invalid path")
else:
    # Perform necessary actions

PHP

$path = $_GET['path'];
$file_path = realpath($path);
if (!strpos($file_path, $base_dir) === 0) {
    return 'Invalid path';
}

How to Ask AI to Check Your Code for Path Traversal

Use a copy-pasteable prompt with an AI coding assistant:

Review the following [language] code block for potential CWE-29 Path Traversal vulnerabilities and rewrite it using canonicalization or whitelisting: [paste code here]

Path Traversal Best Practices Checklist

✅ Always properly validate and sanitize external input using techniques such as canonicalization or whitelisting. ✅ Restrict directory traversal sequences, such as ‘..’ or ‘'. ✅ Ensure that file paths are properly canonicalized.

Path Traversal FAQ

How does Path Traversal occur?

Path Traversal occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences that can resolve to a location outside of that directory.

What are the common consequences of a successful Path Traversal attack?

The common consequences of a successful Path Traversal attack include reading or modifying files or directories outside of the intended restricted directory, which can lead to confidentiality and integrity breaches.

How can I prevent Path Traversal attacks?

To prevent Path Traversal attacks, it is essential to properly validate and sanitize user input to ensure that it does not contain any malicious sequences that can resolve to a location outside of the intended restricted directory.

What are some common frameworks and platforms affected by Path Traversal vulnerabilities?

Path Traversal vulnerabilities can occur in various frameworks and platforms, including web applications built using Java, Python, Node.js, PHP, and others.

Can AI coding assistants help detect and prevent Path Traversal vulnerabilities?

Yes, AI coding assistants can be used to review code for potential CWE-29 Path Traversal vulnerabilities and provide recommendations for remediation.

What are some best practices for preventing Path Traversal attacks in web applications?

Some best practices for preventing Path Traversal attacks in web applications include using input validation and sanitization, restricting directory traversal sequences, and ensuring that file paths are properly canonicalized.

How can I determine if my website is vulnerable to Path Traversal attacks?

To determine if your website is vulnerable to Path Traversal attacks, you can use automated scanning tools or perform manual testing using a web browser.

Vulnerabilities Related to Path Traversal

References

• MITRE CWE-29
• CAPEC-1234
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Traversal and other risks before an attacker does.