hunting-path-traversal-and-file-access

Hunting path traversal and file access: when a name escapes its directory

Applications constantly turn a name into a file: a download parameter into a file to send, an upload name into a destination to write, a template name into an include, a route into a static asset. The danger is that a filesystem path is hierarchical, and a name carrying dot-dot segments, an absolute prefix, or a drive letter can climb out of the directory the code meant to stay in. When that happens a read reaches secrets, configuration, or source outside the intended base, and a write lands a file, sometimes an executable one, where it should never go. The reliable defense is to resolve the path to a canonical absolute form and then confirm it is still under the intended base, but many applications check the raw input before decoding or normalizing, which an encoded or layered payload walks straight past. You find these by locating every path built from input and asking whether confinement is verified after canonicalization.

When to use

• Untrusted input names a file to read, write, include, or send: downloads, uploads, templates, static routes.
• Archive extraction or a bulk import writes members to paths derived from the archive.
• A path is validated against a base directory and you need to confirm the check survives normalization.

Scope check

Test path traversal only against applications you own or are authorized to assess, on non-production data, because a confirming read exposes real files and a confirming write can corrupt or plant content. Read a benign marker file and write to a scratch location for any proof, and prefer an isolated instance. If you can't name the authorization, stop.

The loop

1. Establish whether confinement is checked after canonicalization first. For each path built from input, find where and how the code confirms the target stays under the intended base. This is the false-positive killer: resolving to a canonical absolute path and verifying it is a descendant of the base directory holds, while a check on the raw input before decoding or normalization, or a blocklist of dot-dot, is bypassable. Name the check and when it runs relative to normalization.