39
print "<ul>\n";
while (<$fh>) {
print "<li>$_</li>\n";
}
print "</ul>\n";
While the programmer intends to access files such as "/users/cwe/profiles/alice" or "/users/cwe/
profiles/bob", there is no verification of the incoming user parameter. An attacker could provide a
string such as:
Example Language: (Attack)
../../../etc/passwd
The program would generate a profile pathname like this:
Example Language: (Result)
/users/cwe/profiles/../../../etc/passwd
When the file is opened, the operating system resolves the "../" during path canonicalization and
actually accesses this file:
Example Language: (Result)
/etc/passwd
As a result, the attacker could read the entire text of the password file.
Notice how this code also contains an error message information leak (CWE-209) if the user
parameter does not produce a file that exists: the full pathname is provided. Because of the lack
of output encoding of the file that is retrieved, there might also be a cross-site scripting problem
(CWE-79) if profile contains any HTML, but other code would need to be examined.
Example 2:
In the example below, the path to a dictionary file is read from a system property and used to
initialize a File object.
Example Language: Java (Bad)
String filename = System.getProperty("com.domain.application.dictionaryFile");
File dictionaryFile = new File(filename);
However, the path is not validated or modified to prevent it from containing relative or absolute
path sequences before creating the File object. This allows anyone who can control the system
property to determine what file is used. Ideally, the path should be resolved relative to some kind of
application or user home directory.
Example 3:
The following code takes untrusted input and uses a regular expression to filter "../" from the input.
It then appends this result to the /home/user/ directory and attempts to read the file in the final
resulting path.
Example Language: Perl (Bad)
my $Username = GetUntrustedInput();
$Username =~ s/\.\.\///;
my $filename = "/home/user/" . $Username;
ReadAndSendFile($filename);
CWE Version 4.14
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22: Improper Limitation of a Pathname
to a Restricted Directory ('Path Traversal') 40
Since the regular expression does not have the /g global match modifier, it only removes the first
instance of "../" it comes across. So an input value such as:
Example Language: (Attack)
../../../etc/passwd
will have the first "../" stripped, resulting in:
Example Language: (Result)
../../etc/passwd
This value is then concatenated with the /home/user/ directory:
Example Language: (Result)
/home/user/../../etc/passwd
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../
sequences in the pathname. This leads to relative path traversal (CWE-23).
Example 4:
The following code attempts to validate a given input path by checking it against an allowlist and
once validated delete the given file. In this specific case, the path is considered valid if it starts with
the string "/safe_dir/".
Example Language: Java (Bad)
String path = getInputPath();
if (path.startsWith("/safe_dir/"))
{
File f = new File(path);
f.delete()
}
An attacker could provide an input such as this:
Example Language: (Attack)
/safe_dir/../important.dat
The software assumes that the path is valid because it starts with the "/safe_path/" sequence, but
the "../" sequence will cause the program to delete the important.dat file in the parent directory
Example 5:
The following code demonstrates the unrestricted upload of a file with a Java servlet and a path
traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the
Java servlet.
Example Language: HTML (Good)
<form action="FileUploadServlet" method="post" enctype="multipart/form-data">
Choose a file to upload:
<input type="file" name="filename"/>
<br/>
<input type="submit" name="submit" value="Submit"/>
</form>
CWE Version 4.14
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22: Improper Limitation of a Pathname
to a Restricted Directory ('Path Traversal')