53
[REF-192]OWASP. "OWASP Attack listing". < http://www.owasp.org/index.php/
Relative_Path_Traversal >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-1282]Snyk. "Zip Slip Vulnerability". 2018 June 5. < https://security.snyk.io/research/zip-slipvulnerability
>.
CWE-24: Path Traversal: '../filedir'
Weakness ID : 24
Structure : Simple
Abstraction : Variant
Description
The product uses external input to construct a pathname that should be within a restricted
directory, but it does not properly neutralize "../" sequences that can resolve to a location that is
outside of that directory.
Extended Description
This allows attackers to traverse the file system to access files or directories that are outside of the
restricted directory.
The "../" manipulation is the canonical manipulation for operating systems that use "/" as directory
separators, such as UNIX- and Linux-based systems. In some cases, it is useful for bypassing
protection schemes in environments for which "/" is supported but not the primary separator, such
as Windows, which uses "\" but can also accept "/".
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 23 Relative Path Traversal 46
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
CWE Version 4.14
CWE-25: Path Traversal: '/../filedir'
CWE-25: Path Traversal: '/../filedir'