Home > CAPEC List > CAPEC-597: Absolute Path Traversal (Version 2.9)  

CAPEC-597: Absolute Path Traversal

 
Absolute Path Traversal
Definition in a New Window Definition in a New Window
Attack Pattern ID: 597
Abstraction: Detailed
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An adversary with access to file system resources, either directly or via application logic, will use various file absolute paths and navigation mechanisms such as ".." to extend their range of access to inappropriate areas of the file system. The goal of the adversary is to access directories and files that are intended to be restricted from their access.

+ Attack Prerequisites
  • The target must leverage and access an underlying file system.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

Simple command line attacks.

Skill or Knowledge Level: Medium

Programming attacks.

+ Resources Required

The attacker must have access to an application interface or a direct shell that allows them to inject directory strings and monitor the results.

+ Solutions and Mitigations

Design: Configure the access control correctly.

Design: Enforce principle of least privilege.

Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution.

Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement.

Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host.

Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.

Implementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin.

Implementation: Perform input validation for all remote content, including remote and user-generated content.

Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.

Implementation: Use indirect references rather than actual file names.

Implementation: Use possible permissions on file access when developing and deploying web applications.

Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- whitelisting approach.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Integrity
Confidentiality
Availability
Execute unauthorized code or commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Modify files or directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Read files or directories
The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
DoS: crash / exit / restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the software from working at all and in the case of a protection mechanisms such as authentication, it has the potential to lockout every user of the software.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2017-01-06Internal_CAPEC_Team

More information is available — Please select a different filter.
Page Last Updated or Reviewed: January 06, 2017