Path Traversal
Path traversal is an attack in which the attacker tries to step out of the permitted directory and reach files the application should never display. The best-known pattern is a sequence such as `../`, which walks the path back up the file system level by level.
Term
description · examples · notesPath traversal is an attack in which the attacker tries to step out of the permitted directory and reach files the application should never display. The best-known pattern is a sequence such as `../`, which walks the path back up the file system level by level.
Description
This vulnerability often appears in functions for downloading files, displaying documents, loading templates or reading images. If the application turns user input directly into a file path, the attacker can try to read configurations, passwords, source code and system files.
Path traversal looks simple, but the consequences can be serious. One configuration file read can reveal database credentials, API keys and internal paths, and from there the attack is no longer reading but a breach of the application.
Examples
- A file download parameter accepts `../../../../etc/passwd` and returns the contents of a system file.
- A document viewer application allows a configuration file outside the authorized directory to be read.
- A vulnerable VPN or network device allows files holding sessions or credentials to be read through path manipulation.
Notes
- The problem is not only the `../` characters. Paths can be encoded, normalized and bypassed in several ways if the application has no clearly bounded permissions.
- The best protection is that the user never chooses the real path. The application should map permitted files through internal identifiers.
Mentioned in the news
Techniques
carried out with 2Techniques used to carry it out. Select one to open its page.
Defenses
countered by 3How it is defended against. Select one to open its page.