What is Path Traversal (CWE-30)?

TL;DR: Path Traversal (CWE-30) is a critical vulnerability that occurs when an application fails to properly neutralize sequences in external input that can resolve to a location outside of a restricted directory. To fix it, implement proper input validation and whitelisting approved paths.

What is Path Traversal?

Path Traversal (CWE-30) is a type of vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize sequences that can resolve to a location outside of that directory. As defined by the MITRE Corporation under CWE-30, and classified by the OWASP Foundation as not directly mapped, Path Traversal is a critical vulnerability that can lead to unauthorized access to sensitive data, modification of system files, and disruption of system availability.

Quick Summary

Path Traversal (CWE-30) is a critical vulnerability that occurs when an application fails to properly neutralize sequences in external input that can resolve to a location outside of a restricted directory. The business impact includes unauthorized access to sensitive data, modification of system files, and disruption of system availability. To prevent this vulnerability, implement proper input validation and whitelisting approved paths.

Jump to: Quick Summary · Path Traversal Overview · How Path Traversal Works · Business Impact of Path Traversal · Path Traversal Attack Scenario · How to Detect Path Traversal · How to Fix Path Traversal · Framework-Specific Fixes for Path Traversal · How to Ask AI to Check Your Code for Path Traversal · Path Traversal Best Practices Checklist · Path Traversal FAQ · Vulnerabilities Related to Path Traversal · References · Scan Your Own Site

Path Traversal Overview

What: Path Traversal (CWE-30) is a type of vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize sequences that can resolve to a location outside of that directory.

Why it matters: The business impact of Path Traversal includes unauthorized access to sensitive data, modification of system files, and disruption of system availability. It is essential to prevent this vulnerability through proper input validation and whitelisting approved paths.

Where it occurs: Path Traversal can occur in any application that uses external input to construct pathnames, including web applications, file systems, and databases.

Who is affected: Any organization or individual that uses an application vulnerable to Path Traversal is at risk of experiencing unauthorized access to sensitive data, modification of system files, and disruption of system availability.

How Path Traversal Works

Root Cause

Path Traversal occurs when an application uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize sequences that can resolve to a location outside of that directory.

Attack Flow

1. An attacker sends malicious input to the application.
2. The application processes the input and constructs a pathname.
3. If the application fails to properly neutralize sequences in the input, it may resolve to a location outside of the restricted directory.

Prerequisites to Exploit

• The application must use external input to construct pathnames.
• The application must fail to properly neutralize sequences in the input.

Vulnerable Code

import os

path = request.args.get('path')
os.chdir(path)

This code is vulnerable because it uses user-inputted data to change the current working directory without proper validation or sanitization.

Secure Code

import os

path = request.args.get('path')

# Validate and sanitize the input
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")

os.chdir(path)

This code is secure because it validates and sanitizes the input before using it to change the current working directory.

Business Impact of Path Traversal

The business impact of Path Traversal includes:

• Unauthorized access to sensitive data
• Modification of system files
• Disruption of system availability

These impacts can have significant financial, compliance, and reputational consequences for organizations that experience a Path Traversal vulnerability.

Confidentiality: Sensitive data may be accessed or stolen by unauthorized parties.

Integrity: System files may be modified or deleted by unauthorized parties.

Availability: Systems may become unavailable due to modifications or deletions made by unauthorized parties.

Path Traversal Attack Scenario

1. An attacker sends malicious input to the application.
2. The application processes the input and constructs a pathname.
3. If the application fails to properly neutralize sequences in the input, it may resolve to a location outside of the restricted directory.
4. The attacker gains unauthorized access to sensitive data or modifies system files.

How to Detect Path Traversal

Manual Testing

• Use tools like Burp Suite or ZAP to send malicious input to the application.
• Monitor the application’s behavior and look for signs of Path Traversal, such as unauthorized access to sensitive data or modification of system files.

Automated Scanners (SAST / DAST)

• Use automated scanning tools like Snyk or Veracode to identify potential vulnerabilities in the application.
• These tools can help detect Path Traversal by identifying input validation issues and whitelisting approved paths.

PenScan Detection

PenScan’s scanner engines actively test for this issue. Our scanners use a combination of manual testing and automated scanning tools to identify potential vulnerabilities in applications.

False Positive Guidance

When detecting Path Traversal, be aware that some patterns may look risky but are actually safe due to context. For example, if the application uses a whitelist of approved paths, it may appear to be vulnerable to Path Traversal, but is actually secure.

How to Fix Path Traversal

To fix Path Traversal, implement proper input validation and whitelisting approved paths. This can be achieved through:

• Validating user-inputted data to ensure it conforms to expected formats.
• Sanitizing user-inputted data to remove any malicious sequences.
• Using a whitelist of approved paths to restrict access to sensitive areas.

Framework-Specific Fixes for Path Traversal

Java

import java.io.File;

String path = request.getParameter("path");

// Validate and sanitize the input
if (!new File(path).isAbsolute()) {
    throw new ServletException("Invalid path");
}

// Whitelist approved paths
if (path.startsWith("/approved/path")) {
    // Process the request
} else {
    throw new ServletException("Unauthorized access");
}

Node.js

const express = require('express');
const fs = require('fs');

app.get('/path', function(req, res) {
  const path = req.query.path;

  // Validate and sanitize the input
  if (!fs.existsSync(path)) {
    return res.status(404).send("Invalid path");
  }

  // Whitelist approved paths
  if (path.startsWith("/approved/path")) {
    // Process the request
  } else {
    return res.status(403).send("Unauthorized access");
  }
});

Python/Django

from django.http import HttpResponse
import os

def path_view(request):
  path = request.GET.get('path')

  # Validate and sanitize the input
  if not os.path.exists(path):
    return HttpResponse("Invalid path", status=404)

  # Whitelist approved paths
  if path.startswith("/approved/path"):
    # Process the request
  else:
    return HttpResponse("Unauthorized access", status=403)

PHP

<?php

$app->get('/path', function($request, $response) {
  $path = $request->getQueryParam('path');

  // Validate and sanitize the input
  if (!file_exists($path)) {
    return $response->withStatus(404)->write("Invalid path");
  }

  // Whitelist approved paths
  if (strpos($path, "/approved/path") === 0) {
    // Process the request
  } else {
    return $response->withStatus(403)->write("Unauthorized access");
  }
});

How to Ask AI to Check Your Code for Path Traversal

You can use an AI-powered coding assistant like CodePro or Kite to review your code and identify potential vulnerabilities. Simply copy-paste the following prompt:

“Review the following Python code block for potential CWE-30 Path Traversal vulnerabilities and rewrite it using input validation: ```python import os

path = request.args.get(‘path’) os.chdir(path) ```

Path Traversal Best Practices Checklist

✅ Implement proper input validation to ensure user-inputted data conforms to expected formats.

✅ Sanitize user-inputted data to remove any malicious sequences.

✅ Use a whitelist of approved paths to restrict access to sensitive areas.

✅ Regularly review and update your application’s security configuration to prevent Path Traversal vulnerabilities.

Path Traversal FAQ

How does Path Traversal occur?

Path Traversal occurs when an application uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize sequences that can resolve to a location outside of that directory.

What is the business impact of Path Traversal?

The business impact of Path Traversal includes unauthorized access to sensitive data, modification of system files, and disruption of system availability.

How do I detect Path Traversal in my application?

You can detect Path Traversal by using a combination of manual testing and automated scanning tools.

What is the primary prevention technique for Path Traversal?

The primary prevention technique for Path Traversal is input validation, specifically verifying that all user-inputted data is properly sanitized and within allowed directories.

How do I fix Path Traversal in my application?

You can fix Path Traversal by implementing proper input validation, using a whitelist of approved paths, and ensuring that all sensitive files are stored outside of web-accessible directories.

Can AI assist me in detecting and preventing Path Traversal?

Yes, AI-powered coding assistants can help you identify potential vulnerabilities and provide recommendations for remediation.

What are some best practices to prevent Path Traversal?

Best practices include using input validation, whitelisting approved paths, storing sensitive files outside of web-accessible directories, and regularly reviewing and updating your application’s security configuration.

Vulnerabilities Related to Path Traversal

This table lists the vulnerabilities related to Path Traversal. CWE-30 is a more specific variant of CWE-23, which is a relative path traversal vulnerability.

References

• MITRE: CWE-30
• CAPEC: None known
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Traversal and other risks before an attacker does.