What is Path Traversal (CWE-35)?

TL;DR: Path Traversal (CWE-35) occurs when an application uses external input to construct a pathname that resolves outside of a restricted directory, allowing attackers to access files or directories that are not intended to be accessible. The primary prevention technique is input validation.

What is Path Traversal?

Path Traversal (CWE-35) is a type of vulnerability that occurs when an application uses external input to construct a pathname that resolves outside of a restricted directory. As defined by the MITRE Corporation under CWE-35, and classified by the OWASP Foundation under Not directly mapped…

Quick Summary

Path Traversal can have severe business impacts, including loss of sensitive data, unauthorized modification of critical systems, and reputational damage due to security breaches. It occurs when an application uses external input to construct a pathname that resolves outside of a restricted directory.

Jump to: Quick Summary · Path Traversal Overview · How Path Traversal Works · Business Impact of Path Traversal · Path Traversal Attack Scenario · How to Detect Path Traversal · How to Fix Path Traversal · Framework-Specific Fixes for Path Traversal · How to Ask AI to Check Your Code for Path Traversal · Path Traversal Best Practices Checklist · Path Traversal FAQ · Vulnerabilities Related to Path Traversal · References · Scan Your Own Site

Path Traversal Overview

What: Path Traversal (CWE-35) is a type of vulnerability that occurs when an application uses external input to construct a pathname that resolves outside of a restricted directory.

Why it matters: The business impact of Path Traversal can include loss of sensitive data, unauthorized modification of critical systems, and reputational damage due to security breaches.

Where it occurs: Path Traversal can occur in any application that constructs paths or queries from external input.

Who is affected: Any organization using an application vulnerable to Path Traversal may be affected by this vulnerability.

How Path Traversal Works

Root Cause

Path Traversal occurs when an application uses external input to construct a pathname that resolves outside of a restricted directory, allowing attackers to access files or directories that are not intended to be accessible.

Attack Flow

1. An attacker submits malicious input to the application.
2. The application constructs a pathname using the malicious input.
3. The constructed pathname resolves outside of the restricted directory, allowing the attacker to access sensitive data.

Prerequisites to Exploit

• External input must reach a dangerous sink (e.g., file system, database).
• The application must not properly validate or sanitize user input.

Vulnerable Code

import os

path = request.args.get('path')
os.chdir(path)

This code is vulnerable because it uses external input to construct a pathname without proper validation or sanitization.

Secure Code

import os

base_dir = '/restricted_directory'
path = request.args.get('path')

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Path traversal detected")
else:
    os.chdir(path)

This code is secure because it properly validates and sanitizes user input before constructing a pathname.

Business Impact of Path Traversal

Confidentiality: Loss of sensitive data due to unauthorized access.

• Integrity: Unauthorized modification of critical systems.
• Availability: Disruption of service due to security breaches.

The business impact of Path Traversal can include loss of sensitive data, unauthorized modification of critical systems, and reputational damage due to security breaches. Real-world consequences may include:

• Financial losses due to data breaches or system compromise
• Compliance issues due to regulatory non-compliance
• Reputational damage due to public disclosure of security breaches

Path Traversal Attack Scenario

1. An attacker submits malicious input to the application.
2. The application constructs a pathname using the malicious input.
3. The constructed pathname resolves outside of the restricted directory, allowing the attacker to access sensitive data.

How to Detect Path Traversal

Manual Testing

• Verify that user input is properly validated and sanitized before constructing a pathname.
• Test for path traversal by submitting malicious input to the application.

Automated Scanners (SAST / DAST)

• Use static analysis tools to detect potential vulnerabilities in code.
• Use dynamic testing tools to simulate attacks on the application.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

Be cautious of false positives due to legitimate path traversal patterns. Verify that the detected vulnerability is not a result of a legitimate business requirement.

How to Fix Path Traversal

• Use input validation techniques, such as assuming all input is malicious and using an “accept known good” strategy.
• Properly validate and sanitize user input before constructing a pathname.
• Implement secure coding practices, such as using secure libraries and frameworks.

Framework-Specific Fixes for Path Traversal

Java

import java.io.File;

String path = request.getParameter("path");
File file = new File(path);

if (!file.getAbsoluteFile().startsWith(base_dir)) {
    throw new SecurityException("Path traversal detected");
}

Node.js

const express = require('express');
const fs = require('fs');

app.use(express.urlencoded({ extended: true }));

let path = req.body.path;
let file = fs.realpathSync(path);

if (!file.startsWith(base_dir)) {
    throw new Error("Path traversal detected");
}

Python/Django

from django.http import HttpResponse

path = request.GET.get('path')
base_dir = '/restricted_directory'

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Path traversal detected")
else:
    # Perform secure operation here
    pass

How to Ask AI to Check Your Code for Path Traversal

Review the following [language] code block for potential CWE-35 Path Traversal vulnerabilities and rewrite it using input validation.

Path Traversal Best Practices Checklist

✅ Verify return values. ✅ Test your code thoroughly. ✅ Use a secure coding framework.

Path Traversal FAQ

How does Path Traversal work?

Path Traversal occurs when an application uses external input to construct a pathname that resolves outside of a restricted directory, allowing attackers to access files or directories that are not intended to be accessible.

What is the business impact of Path Traversal?

The business impact of Path Traversal can include loss of sensitive data, unauthorized modification of critical systems, and reputational damage due to security breaches.

How do I detect Path Traversal in my application?

You can detect Path Traversal using manual testing, automated scanners (SAST / DAST), or PenScan’s detection capabilities.

What is the primary prevention technique for Path Traversal?

The primary prevention technique for Path Traversal is input validation, specifically assuming all input is malicious and using an “accept known good” strategy.

How can I ask AI to check my code for Path Traversal?

You can use a copy-pasteable prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-35 Path Traversal vulnerabilities and rewrite it using input validation.”

What are some best practices for preventing Path Traversal?

Some best practices include verifying return values, testing your code, and using a secure coding framework.

How can I scan my own site for Path Traversal vulnerabilities?

You can use PenScan’s automated scanning capabilities to detect potential CWE-35 Path Traversal vulnerabilities.

Vulnerabilities Related to Path Traversal

This table lists related weaknesses that are variants of or have a relationship with Path Traversal (CWE-35).

References

• MITRE CWE-35
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Path Traversal and other risks before an attacker does.