CWE-23 – Relative Path Traversal

Description

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as “..” that can resolve to a location that is outside of that directory.

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Modes of Introduction:

– Implementation

Related Weaknesses

CWE-22
CWE-22
CWE-22

Consequences

Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands

The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.

Integrity: Modify Files or Directories

The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.

Confidentiality: Read Files or Directories

The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.

Availability: DoS: Crash, Exit, or Restart

The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the software from working at all and in the case of a protection mechanisms such as authentication, it has the potential to lockout every user of the software.

Potential Mitigations

Phase: Implementation

Description: 

Phase: Implementation

Description: 

CVE References

• CVE-2002-0298
  • Server allows remote attackers to cause a denial of service via certain HTTP GET requests containing a %2e%2e (encoded dot-dot), several “/../” sequences, or several “../” in a URI.

• CVE-2002-0661
  • “” not in denylist for web server, allowing path traversal attacks when the server is run in Windows and other OSes.

• CVE-2002-0946
  • Arbitrary files may be read files via .. (dot dot) sequences in an HTTP request.

• CVE-2002-1042
  • Directory traversal vulnerability in search engine for web server allows remote attackers to read arbitrary files via “..” sequences in queries.

• CVE-2002-1209
  • Directory traversal vulnerability in FTP server allows remote attackers to read arbitrary files via “..” sequences in a GET request.

• CVE-2002-1178
  • Directory traversal vulnerability in servlet allows remote attackers to execute arbitrary commands via “..” sequences in an HTTP request.

• CVE-2002-1987
  • Protection mechanism checks for “/..” but doesn’t account for Windows-specific “..” allowing read of arbitrary files.

• CVE-2005-2142
  • Directory traversal vulnerability in FTP server allows remote authenticated attackers to list arbitrary directories via a “..” sequence in an LS command.

• CVE-2002-0160
  • The administration function in Access Control Server allows remote attackers to read HTML, Java class, and image files outside the web root via a “….” sequence in the URL to port 2002.

• CVE-2001-0467
  • “…” in web server

• CVE-2001-0963
  • “…” in cd command in FTP server

• CVE-2001-1193
  • “…” in cd command in FTP server

• CVE-2001-1131
  • “…” in cd command in FTP server

• CVE-2001-0480
  • read of arbitrary files and directories using GET or CD with “…” in Windows-based FTP server.

• CVE-2002-0288
  • read files using “.” and Unicode-encoded “/” or “” characters in the URL.

• CVE-2003-0313
  • Directory listing of web server using “…”

• CVE-2005-1658
  • Triple dot

• CVE-2000-0240
  • read files via “/………./” in URL

• CVE-2000-0773
  • read files via “….” in web server

• CVE-1999-1082
  • read files via “……” in web server (doubled triple dot?)

• CVE-2004-2121
  • read files via “……” in web server (doubled triple dot?)

• CVE-2001-0491
  • multiple attacks using “..”, “…”, and “….” in different commands

• CVE-2001-0615
  • “…” or “….” in chat server

• CVE-2005-2169
  • chain: “…/…//” bypasses protection mechanism using regexp’s that remove “../” resulting in collapse into an unsafe value “../” (CWE-182) and resultant path traversal.

• CVE-2005-0202
  • “…/….///” bypasses regexp’s that remove “./” and “../”

• CVE-2004-1670
  • Mail server allows remote attackers to create arbitrary directories via a “..” or rename arbitrary files via a “….//” in user supplied parameters.