What is Path Traversal (CWE-34)?

AI-friendly summary

AI-friendly summary

TL;DR: “Path Traversal (CWE-34) is a vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘….//’ sequences, leading to confidentiality and integrity breaches. It can be prevented through input validation, secure coding practices, and framework-specific fixes.”

Quick Summary

Path Traversal (CWE-34) is a type of vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘….//’ sequences. This can lead to confidentiality and integrity breaches.

Jump to: Quick Summary · What is Path Traversal? · Path Traversal Overview · How Path Traversal Works · Business Impact of Path Traversal · Path Traversal Attack Scenario · How to Detect Path Traversal · How to Fix Path Traversal · Framework-Specific Fixes for Path Traversal · How to Ask AI to Check Your Code for Path Traversal · Path Traversal Best Practices Checklist · Path Traversal FAQ · Vulnerabilities Related to Path Traversal · References · Scan Your Own Site

What is Path Traversal?

As defined by the MITRE Corporation under CWE-34, and classified by the OWASP Foundation as Not directly mapped, path traversal occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘….//’ sequences.

Path Traversal Overview

What: Path Traversal (CWE-34) is a type of vulnerability that occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘….//’ sequences.

Why it matters: The consequences of path traversal include reading files or directories and modifying files or directories, which can lead to confidentiality and integrity breaches.

Where it occurs: Path Traversal (CWE-34) can occur in any application that uses external input to construct a pathname.

Who is affected: Any user who interacts with the vulnerable application may be affected by path traversal vulnerabilities.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by path traversal vulnerabilities.

How Path Traversal Works

Root Cause

Path traversal occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘….//’ sequences.

Attack Flow

1. An attacker sends a malicious request with a crafted pathname.
2. The application processes the request and constructs a pathname using the external input.
3. If the application does not properly neutralize ‘….//’ sequences, the attacker can access files or directories outside of the restricted directory.

Prerequisites to Exploit

• The application must use external input to construct a pathname.
• The application must not properly neutralize ‘….//’ sequences.

Vulnerable Code

import os

path = request.args.get('path')
os.chdir(path)

This code is vulnerable because it uses the request.args.get() method to retrieve an external input, and then passes it directly to the os.chdir() function without proper validation or neutralization of ‘….//’ sequences.

Secure Code

import os

path = request.args.get('path')
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")
os.chdir(path)

This code is secure because it uses the os.path.abspath() function to validate the input path, and then checks if it starts with the base directory before passing it to the os.chdir() function.

Business Impact of Path Traversal

Confidentiality: Path traversal vulnerabilities can lead to confidentiality breaches by allowing attackers to access sensitive files or directories.

Integrity: Path traversal vulnerabilities can lead to integrity breaches by allowing attackers to modify files or directories.

Availability: Path traversal vulnerabilities can lead to availability breaches by allowing attackers to disrupt the application’s functionality.

The business impact of path traversal vulnerabilities includes:

• Confidentiality breaches: Sensitive files or directories may be accessed, leading to data breaches.
• Integrity breaches: Files or directories may be modified, leading to data corruption.
• Availability breaches: The application’s functionality may be disrupted, leading to downtime and lost revenue.

Path Traversal Attack Scenario

1. An attacker sends a malicious request with a crafted pathname.
2. The application processes the request and constructs a pathname using the external input.
3. If the application does not properly neutralize ‘….//’ sequences, the attacker can access files or directories outside of the restricted directory.

How to Detect Path Traversal

Manual Testing

• Use a tool like Burp Suite or ZAP to send malicious requests with crafted pathnames.
• Monitor the application’s behavior and look for signs of path traversal vulnerabilities.

Automated Scanners (SAST / DAST)

• Use an automated scanner like Veracode or Fortify to detect path traversal vulnerabilities.
• These scanners can identify potential vulnerabilities by analyzing code and identifying patterns that indicate path traversal.

PenScan Detection

• PenScan’s scanner engines, such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap, can detect path traversal vulnerabilities.
• These scanners use a combination of static analysis and dynamic testing to identify potential vulnerabilities.

False Positive Guidance

• When using automated scanners or PenScan detection, be aware that some findings may be false positives.
• Use manual testing and code review to verify the existence of path traversal vulnerabilities.

How to Fix Path Traversal

• Input validation: Validate external input to ensure it does not contain ‘….//’ sequences.
• Secure coding practices: Follow secure coding practices, such as using os.path.abspath() to validate paths.
• Framework-specific fixes: Use framework-specific fixes, such as those provided by the OWASP Foundation.

Framework-Specific Fixes for Path Traversal

Java

import java.io.File;

String path = request.getParameter("path");
File file = new File(path);
if (!file.getAbsoluteFile().startsWith(baseDir)) {
    throw new SecurityException("Invalid path");
}

This code is secure because it uses the File class to validate the input path, and then checks if it starts with the base directory before processing it.

Node.js

const path = require('path');

let pathname = req.query.path;
if (!path.isAbsolute(pathname)) {
    throw new Error("Invalid path");
}

This code is secure because it uses the path module to validate the input path, and then checks if it is absolute before processing it.

Python/Django

import os

pathname = request.GET.get('path')
if not os.path.abspath(pathname).startswith(base_dir):
    raise ValueError("Invalid path")

This code is secure because it uses the os.path.abspath() function to validate the input path, and then checks if it starts with the base directory before processing it.

PHP

$path = $_GET['path'];
if (!is_absolute_path($path)) {
    throw new Exception("Invalid path");
}

This code is secure because it uses a custom is_absolute_path() function to validate the input path, and then checks if it is absolute before processing it.

How to Ask AI to Check Your Code for Path Traversal

You can ask AI to review your code block for potential CWE-34 Path Traversal vulnerabilities and rewrite it using primary fix techniques such as input validation.

Path Traversal Best Practices Checklist

✅ Validate external input to ensure it does not contain ‘….//’ sequences. ✅ Use secure coding practices, such as using os.path.abspath() to validate paths. ✅ Follow framework-specific fixes, such as those provided by the OWASP Foundation.

Path Traversal FAQ

How does path traversal work?

Path traversal occurs when an application uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘….//’ sequences that can resolve to a location outside of that directory.

What are the consequences of path traversal?

The consequences of path traversal include reading files or directories and modifying files or directories, which can lead to confidentiality and integrity breaches.

How do I detect path traversal vulnerabilities?

Path traversal vulnerabilities can be detected through manual testing, automated scanners (SAST / DAST), and PenScan detection.

What are the best practices for preventing path traversal?

The best practices for preventing path traversal include input validation, secure coding practices, and framework-specific fixes.

How do I ask AI to check my code for path traversal?

You can ask AI to review your code block for potential CWE-34 Path Traversal vulnerabilities and rewrite it using primary fix techniques such as input validation.

What are the related vulnerabilities to path traversal?

The related vulnerabilities to path traversal include Relative Path Traversal (CWE-23), which is a more specific variant of path traversal.

Vulnerabilities Related to Path Traversal

References

• MITRE CWE-34
• CAPEC page (if applicable)
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Traversal and other risks before an attacker does.