Directory traversal attack

Directory traversal (or path traversal) consists of exploiting insufficient security checks / sanitization of user-supplied file names, such that characters representing «traversal to the parent directory» are passed to the file API.

The goal of this attack is to use a vulnerable application to gain unauthorized access to the file system. This attack exploits a security weakness (the software behaves exactly as it is designed to) rather than a bug in the code.

Directory traversal is also known as the ../ attack (dot-dot-slash), directory climbing, and backtracking. Some forms of this attack are also canonicalization attacks.

Example

A typical example of a vulnerable application in PHP code:

An attack against this system could be sending the following HTTP request:

GET  /vulnerable.php  HTTP / 1.0
Cookie :  TEMPLATE = .. / .. / .. / .. / .. / .. / .. / .. / .. / etc / passwd

Producing a server response such as:

HTTP / 1.0  200  OK
Content-Type :  text / html
Сервер :  Apache
 root: fi3swerwerqR6: 0: 1:
Системный оператор: /: / bin / ksh
demon : *: 1: 1 :: / TMP:
phpru: werwerj1OIf31:. 182: 100:
dev: / main/users/home/: / bin / CSH

Repeated

characters after

forced

to move up to the root directory, and then include the Unix password file

.

Unix

is a common file used to demonstrate directory traversal, since it is often used by crackers for password cracking.

However, on newer Unix systems the passwd file does not contain hashed passwords. Instead, they are stored in a shadow file that cannot be read by unprivileged users on the machine. Nevertheless, it is still useful for enumerating accounts on the machine, since it still lists the user accounts on the system.

Variations of directory traversal

Listed below are some well-known directory traversal attack strings:

Directory traversal on Unix

The typical Unix-like directory traversal uses

characters. Sudo, the ubiquitous Unix privilege-management program, is vulnerable to this attack when users use a wildcard «glob» (for example, chown /opt/myapp/myconfig/*can be used with the command sudo chown baduser /opt/myapp/myconfig/../../../etc/passwd).

Directory traversal on Microsoft Windows

Microsoft Windows and DOS directory traversal uses the character sequences ..\ or ../ (dots and forward or backward slash)

Each partition has a separate root directory (marked

This type of attack has caused numerous Microsoft vulnerabilities.

URI-encoded directory traversal

A canonicalization issue.

Some web applications scan the query string for dangerous characters, such as:

• ..
• ..\
• ../

to prevent directory traversal. However, the query string is usually URI-decoded before use. Therefore, these applications are vulnerable to percent-encoded directory traversal, for example:

• %2e%2e%2f which is equivalent to ../
• %2e%2e/ which is equivalent to ../
• ..%2f which is equivalent to ../
• %2e%2e%5c which is equivalent to ..\

Unicode / UTF-8-encoded directory traversal

A canonicalization issue.

UTF-8 was noted by Bruce Schneier and Jeffrey Streifling as a source of vulnerabilities and attack vectors.

When Microsoft added Unicode support to its web server, ../

a new way of encoding was introduced into their code, as a result of which their directory-traversal prevention attempts were bypassed.

Several percent-encodings, such as

• %c1%1c
• %c0%af

translated into / or \ characters.

Percent-encodings were decoded into corresponding 8-bit characters by Microsoft's web server. This was historically correct behavior, since Windows and DOS traditionally used canonical 8-bit ASCII-based character sets.

However, the original UTF-8 was not canonical, and several strings were now string encodings that translated into the same string. Microsoft performed anti-traversal checks without UTF-8 canonicalization and therefore did not notice that ( HEX )

and ( HEX )

were the same character when comparing strings. Incorrect percent-encoding, such as

was also used.

Zip / archive traversal attacks

Using archive formats such as zip allows directory traversal attacks to be carried out: files in the archive can be written in such a way that they overwrite files in the file system by traversing back up. Code that unpacks archive files can be written to verify that the file paths in the archive do not involve path traversal.

Possible methods for preventing directory traversal

A possible algorithm for preventing directory traversal should be as follows:

1. Process URI requests that do not result in a file request, for example by performing interception in user code before proceeding below.
2. When a URI request for a file/directory must be executed, build the full path to the file/directory if it exists, and normalize all characters (for example,
   %20
   convert to spaces).
3. Assume that the «Document Root» is a known, full, normalized path, and that this string has length N. Assume that no files outside this directory can be served.
4. Verify that the first N characters of the full path of the requested file exactly match the «Document Root».
5. If so, allow the file to be returned.
6. If not, return an error, since the request clearly falls outside what the web server should be allowed to serve.
7. Using a hard-coded, predefined file extension as a path suffix does not limit the attack surface to files with that extension.

A user can use the NULL character (indicating end of string) to bypass everything after $_GET. (This is PHP-dependent.)

See also

• Chroot jails can be exposed to directory traversal if the chroot jail is set up incorrectly.
• Possible directory traversal attack vectors are open directory file descriptors outside the jail.
• The working directory is another possible attack vector.