450
This script creates a subdirectory within a user directory and sets the user as the owner.
Example Language: PHP (Bad)
function createDir($userName,$dirName){
$userDir = '/users/'. $userName;
if(strpos($dirName,'..') !== false){
echo 'Directory name contains invalid sequence';
return;
}
//filter out '~' because other scripts identify user directories by this prefix
$dirName = str_replace('~','',$dirName);
$newDir = $userDir . $dirName;
mkdir($newDir, 0700);
chown($newDir,$userName);
}
While the script attempts to screen for '..' sequences, an attacker can submit a directory path
including ".~.", which will then become ".." after the filtering step. This allows a Path Traversal
(CWE-21) attack to occur.
Observed Examples
Reference Description
CVE-2002-0433 Product allows remote attackers to view restricted files via an HTTP request
containing a "*" (wildcard or asterisk) character.
https://www.cve.org/CVERecord?id=CVE-2002-0433
CVE-2003-0332 Product modifies the first two letters of a filename extension after performing
a security check, which allows remote attackers to bypass authentication via a
filename with a .ats extension instead of a .hts extension.
https://www.cve.org/CVERecord?id=CVE-2003-0332
CVE-2002-0802 Database consumes an extra character when processing a character that
cannot be converted, which could remove an escape character from the query
and make the application subject to SQL injection attacks.
https://www.cve.org/CVERecord?id=CVE-2002-0802
CVE-2000-0191 Overlaps "fakechild/../realchild"
https://www.cve.org/CVERecord?id=CVE-2000-0191
CVE-2004-2363 Product checks URI for "<" and other literal characters, but does it before hex
decoding the URI, so "%3E" and other sequences are allowed.
https://www.cve.org/CVERecord?id=CVE-2004-2363
CVE-2002-0934 Directory traversal vulnerability allows remote attackers to read or modify
arbitrary files via invalid characters between two . (dot) characters, which are
filtered and result in a ".." sequence.
https://www.cve.org/CVERecord?id=CVE-2002-0934
CVE-2003-0282 Directory traversal vulnerability allows attackers to overwrite arbitrary files via
invalid characters between two . (dot) characters, which are filtered and result
in a ".." sequence.
https://www.cve.org/CVERecord?id=CVE-2003-0282
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 884 CWE Cross-section 884 2567
MemberOf 992 SFP Secondary Cluster: Faulty Input Transformation 888 2416
CWE Version 4.14
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize