Path Traversal

ID

csharp.path_traversal

Severity

critical

Resource

Path Resolution

Language

CSharp

Tags

CWE:22, CWE:73, NIST.SP.800-53, OWASP:2021:A4, OWASP:2021:A5, PCI-DSS:6.5.8

Description

Improper limitation of a pathname to a restricted directory.

Path Traversal vulnerabilities exploit improper validation of user inputs when constructing file paths. Attackers can manipulate input to navigate the directory structure and access files outside the intended file directory. This typically involves injecting special characters such as ../, which, when processed, traverse the directory hierarchy.

Rationale

Allowing external input to control paths used in file system operations could allow an attacker to access or modify unintended files.

If the software concatenates external input into a path used during file operations, an attacker could "escape" from the directory reserved for such operations. Depending on the file operations performed by the software, an attacker could read or write arbitrary files, including sensitive application or operating system files, with the permissions granted to the process running the software.

Threat actors can:

  • Exfiltrate sensitive files from the software or the operating system.

  • Modify application configuration files for removing security controls and gaining further access.

  • Upload executable code (typically forcing execution of the uploaded code), which could install malware, open a reverse shell, or perform other malicious actions.

Consider the following C# code, where a file path is constructed from user input:

const string fileName = Request.getParameter("filename");
const string filePath = Path.Combine("/var/www/app/files/", fileName);
const FileStream fs = new FileStream(filePath, FileMode.Open, FileAccess.Read);

If an attacker supplies a filename such as ../etc/passwd, the resulting file path would be /var/www/app/files/../etc/passwd, which may allow access to sensitive system files.

Remediation

To protect against Path Traversal vulnerabilities in applications, consider the following remediation strategies:

  1. Canonicalize the Path: Normalize file paths before processing them using file functions. This ensures that any navigational characters are resolved and the path refers to the correct location. Perform any checks on path after canonicalization.

  2. Whitelisting: Maintain a whitelist of allowed file names or extensions that users can access, rejecting any requests for files not in the whitelist.

  3. Input Validation: Validate incoming parameters rigorously. Reject or safely encode inputs containing harmful patterns, such as .., or control characters.

  4. Least Privilege: Ensure that applications run with the least privilege necessary. Restrict file permissions to prevent unauthorized file access even if paths are manipulated.

  5. Security Audits and SAST: Conduct regular security audits and integrate Static Application Security Testing tools to identify and mitigate Path Traversal vulnerabilities early during development.

By implementing these preventive measures, you can significantly reduce the risk of Path Traversal vulnerabilities, safeguarding your application against unauthorized file access and potential data breaches.

The following example fixes the path traversal vulnerability shown before, using the Path.GetFullPath() method to normalize the path and then check that the path is under the expected directory:

const string fileName = Request.getParameter("filename");
const string baseDirectory = "/var/www/app/files";
const string requestedPath = Path.Combine(baseDirectory, fileName);

// Canonicalize the path
string fullPath = Path.GetFullPath(requestedPath);

// And check that the file is within the intended directory
if (!fullPath.StartsWith(Path.GetFullPath(baseDirectory) + Path.DirectorySeparatorChar))
{
    throw new UnauthorizedAccessException("Access to the requested file is denied.");
}

FileStream fs = new FileStream(fullPath, FileMode.Open, FileAccess.Read);

Configuration

The detector has the following configurable parameters:

  • sources, that indicates the source kinds to check.

  • neutralizations, that indicates the neutralization kinds to check.

Unless you need to change the default behavior, you typically do not need to configure this detector.

References