Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ID

python.path_traversal

Severity

critical

Resource

Path Resolution

Language

Python

Tags

CWE:22, CWE:73, NIST.SP.800-53, OWASP:2021:A4, OWASP:2021:A5, PCI-DSS:6.5.8

Description

Improper limitation of a pathname to a restricted directory.

Path Traversal vulnerabilities exploit improper validation of user inputs when constructing file paths. Attackers can manipulate input to navigate the directory structure and access files outside the intended file directory. This typically involves injecting special characters such as ../, which, when processed, traverse the directory hierarchy.

Rationale

Allowing external input to control paths used in file system operations could allow an attacker to access or modify unintended files.

If the software concatenates external input into a path used during file operations, an attacker could "escape" from the directory reserved for such operations. Depending on the file operations performed by the software, an attacker could read or write arbitrary files, including sensitive application or operating system files, with the permissions granted to the process running the software.

Threat actors can:

  • Exfiltrate sensitive files from the software or the operating system.

  • Modify application configuration files for removing security controls and gaining further access.

  • Upload executable code (typically forcing execution of the uploaded code), which could install malware, open a reverse shell, or perform other malicious actions.

Here’s an insecure Python example where user input is used to read a file:

import os

def read_user_file(filename):
    base_directory = "/home/user/data/"

    # Vulnerable to Path Traversal
    file_path = os.path.join(base_directory, filename)
    with open(file_path, 'r') as file:
        data = file.read()

    return data

In this example, if an attacker supplies ../etc/passwd as the filename, they could read sensitive system files by escaping the intended directory.

Remediation

To protect against Path Traversal vulnerabilities in applications, consider the following remediation strategies:

  1. Canonicalize the Path: Normalize file paths before processing them using file functions. This ensures that any navigational characters are resolved and the path refers to the correct location. Perform any checks on path after canonicalization.

  2. Whitelisting: Maintain a whitelist of allowed file names or extensions that users can access, rejecting any requests for files not in the whitelist.

  3. Input Validation: Validate incoming parameters rigorously. Reject or safely encode inputs containing harmful patterns, such as .., or control characters.

  4. Least Privilege: Ensure that applications run with the least privilege necessary. Restrict file permissions to prevent unauthorized file access even if paths are manipulated.

  5. Security Audits and SAST: Conduct regular security audits and integrate Static Application Security Testing tools to identify and mitigate Path Traversal vulnerabilities early during development.

By implementing these preventive measures, you can significantly reduce the risk of Path Traversal vulnerabilities, safeguarding your application against unauthorized file access and potential data breaches.

Here’s a remedied example using safe practices:

import os

def read_user_file(filename):
    base_directory = "/home/user/data/"
    safe_filename = os.path.normpath(filename)

    # Sanitize the path to stay within the base directory
    file_path = os.path.join(base_directory, safe_filename)

    # Check if the final path is within the intended base directory
    if os.path.commonprefix([file_path, base_directory]) != base_directory:
        raise ValueError("Invalid file path")

    with open(file_path, 'r') as file:
        data = file.read()

    return data

Configuration

The detector has the following configurable parameters:

  • sources, that indicates the source kinds to check.

  • neutralizations, that indicates the neutralization kinds to check.

Unless you need to change the default behavior, you typically do not need to configure this detector.

References