1687
Example Language: (Result)
/home/user/../../etc/passwd
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../
sequences in the pathname. This leads to relative path traversal (CWE-22).
Example 2:
The following code takes untrusted input and uses a substring function to filter a 3-character "../"
element located at the 0-index position of the input string. It then appends this result to the /home/
user/ directory and attempts to read the file in the final resulting path.
Example Language: Perl (Bad)
my $Username = GetUntrustedInput();
if (substr($Username, 0, 3) eq '../') {
$Username = substr($Username, 3);
}
my $filename = "/home/user/" . $Username;
ReadAndSendFile($filename);
Since the if function is only looking for a substring of "../" between the 0 and 2 position, it only
removes that specific "../" element. So an input value such as:
Example Language: (Attack)
../../../etc/passwd
will have the first "../" filtered, resulting in:
Example Language: (Result)
../../etc/passwd
This value is then concatenated with the /home/user/ directory:
Example Language: (Result)
/home/user/../../etc/passwd
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../
sequences in the pathname. This leads to relative path traversal (CWE-22).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
CWE-796: Only Filtering Special Elements Relative to a Marker
Weakness ID : 796
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-796: Only Filtering Special Elements Relative to a Marker
CWE-796: Only Filtering Special Elements Relative to a Marker