Home > CAPEC List > CAPEC-213: DEPRECATED: Directory Traversal (Version 2.9)  

CAPEC-213: DEPRECATED: Directory Traversal

DEPRECATED: Directory Traversal
Definition in a New Window Definition in a New Window
Attack Pattern ID: 213
Abstraction: Standard
Status: Deprecated
Completeness: Stub
Presentation Filter:
+ Summary

An attacker with access to file system resources, either directly or via application logic, will use various file path specification or navigation mechanisms such as ".." in path strings and absolute paths to extend their range of access to inappropriate areas of the file system. The attacker attempts to either explore the file system for recon purposes or access directories and files that are intended to be restricted from their access. Exploring the file system can be achieved through constructing paths presented to directory listing programs, such as "ls" and 'dir', or through specially crafted programs that attempt to explore the file system. The attacker engaging in this type of activity is searching for information that can be used later in a more exploitive attack. Access to restricted directories or files can be achieved through modification of path references utilized by system applications.

+ Attack Prerequisites
  • The target must leverage and access an underlying file system.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

Simple command line attacks.

Skill or Knowledge Level: Medium

Programming attacks.

+ Resources Required

The attacker must have access to an application interface or a direct shell that allows them to inject directory strings and monitor the results.

+ Solutions and Mitigations

Design: Configure the access control correctly.

Design: Enforce principle of least privilege.

Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution.

Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement.

Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host.

Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.

Implementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin.

Implementation: Perform input validation for all remote content, including remote and user-generated content.

Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.

Implementation: Use indirect references rather than actual file names.

Implementation: Use possible permissions on file access when developing and deploying web applications.

Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- whitelisting approach.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Execute unauthorized code or commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Modify files or directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Read files or directories
The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
DoS: crash / exit / restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the software from working at all and in the case of a protection mechanisms such as authentication, it has the potential to lockout every user of the software.
+ Content History
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
CAPEC Content TeamThe MITRE Corporation2015-12-07Updated Related_Attack_PatternsInternal
CAPEC Content TeamThe MITRE Corporation2017-01-09Updated Related_Attack_PatternsInternal
Previous Entry Names
DatePrevious Entry Name
2017-01-09Directory Traversal

More information is available — Please select a different filter.
Page Last Updated or Reviewed: January 06, 2017