Directory traversal
2324396
223355688
2008-07-03T18:45:39Z
87.9.58.190
Added path traversal as synonym
A '''directory traversal''' (or '''path traversal''') is to [[Security exploit|exploit]] insufficient security validation / sanitization of user-supplied input file names, so that characters representing "traverse to parent directory" are passed through to the file APIs.
The goal of this attack is to order an application to access a [[computer file]] that is not intended to be accessible. This attack exploits a lack of security (the software is acting exactly as it is supposed to) as opposed to exploiting a bug in the code.
'''Directory traversal''' is also known as the <tt>../</tt> (dot dot slash) attack, [[directory (file systems)|directory]] climbing, and backtracking. Some forms of this attack are also [[canonicalization]] attacks.
== Example ==
A typical example of vulnerable application code is:
<source lang="php">
<?php
$template = 'blue.php';
if ( isset( $_COOKIE['TEMPLATE'] ) )
$template = $_COOKIE['TEMPLATE'];
include ( "/home/users/phpguru/templates/" . $template );
?>
</source>
An attack against this system could be to send the following HTTP request:
<pre>
GET /vulnerable.php HTTP/1.0
Cookie: TEMPLATE=../../../../../../../../../etc/passwd
</pre>
Generating a server response such as:
<pre>
HTTP/1.0 200 OK
Content-Type: text/html
Server: Apache
root:fi3sED95ibqR6:0:1:System Operator:/:/bin/ksh
daemon:*:1:1::/tmp:
phpguru:f8fk3j1OIf31.:182:100:Developer:/home/users/phpguru/:/bin/csh
</pre>
The repeated <tt>../</tt> characters after /home/users/phpguru/templates/ has caused
<code>[http://www.php.net/manual/en/function.include.php include()]</code> to traverse to the root directory, and then include the UNIX password file [[passwd|/etc/passwd]].
UNIX [[passwd|/etc/passwd]] is a common file used to demonstrate '''directory traversal''', as it is often used by [[Hacker (computer security)|crackers]] to try [[password cracking|cracking]] the passwords.
== Variations of directory traversal ==
Directory traversal is trickier to prevent than it might seem. A "filter out known bad characters" protection strategy is likely to '''fail'''.
There are many other factors involved that would determine whether a directory traversal would actually work. However, if the application does not validate the legitimacy of such parameters, it is quite likely that attackers may have some wiggle room to exploit this functionality for malicious purposes.
Listed below are some known directory traversal attack strings:
=== Directory traversal on UNIX ===
Common [[Unix-like]] directory traversal uses the <tt>../</tt> characters.
=== Directory traversal on Microsoft Windows ===
[[Microsoft Windows]] or [[DOS]] directory traversal uses the <tt>..\</tt> characters.
Today, many Windows programs or APIs also accept [[Unix-like|UNIX-like]] directory traversal characters.
Each partition has a separate root directory (labeled C:\ for a particular partition C) and there is no common root directory above that. This means that for most directory vulnerabilities on Windows, the attack is limited to a single partition.
=== URI encoded directory traversal ===
[[Canonicalization]] problem.
Some web applications scan [[query string]] for dangerous characters such as:
* <tt>..</tt>
* <tt>..\</tt>
* <tt>../</tt>
to prevent directory traversal. However, the query string is usually URI decoded before use. Therefore these applications are vulnerable to [[Percent-encoding|percent encoded]] directory traversal such as:
* <tt>%2e%2e%2f</tt> which translates to <tt>../</tt>
* <tt>%2e%2e/</tt> which translates to <tt>../</tt>
* <tt>..%2f</tt> which translates to <tt>../</tt>
* <tt>%2e%2e%5c</tt> which translates to <tt>..\</tt>
etc.
=== Unicode / UTF-8 encoded directory traversal ===
[[Canonicalization]] problem.
[[UTF-8]] was noted as a source of vulnerabilities and attack vectors in [http://www.schneier.com/crypto-gram-0007.html Cryptogram Newsletter July 2000] by [[Bruce Schneier]] and Jeffrey Streifling.
When Microsoft added [[unicode]] support to their Web server, a new way of encoding <tt>../</tt> was introduced into their code, causing their attempts at directory traversal prevention to be circumvented.
Multiple percent encodings, such as
* <tt>%c1%1c</tt>
* <tt>%c0%9v</tt>
* <tt>%c0%af</tt>
translated into <tt>/</tt> or <tt>\</tt> characters.
Why? Percent encodings were decoded into the corresponding 8-bit characters by Microsoft webserver. This has historically been correct behavior as Windows and [[DOS]] traditionally used [[canonical]] 8-bit characters sets based upon of [[ASCII]].
However, the original [[UTF-8]] was not canonical, and several strings were now string encodings translatable into the same string. Microsoft performed the anti-traversal checks without UTF-8 [[canonicalization]], and therefore not noticing that ([[Hexadecimal|HEX]]) <tt>C0AF</tt> and ([[Hexadecimal|HEX]]) <tt>2F</tt> were the same character when doing [[String (computer science)|string]] comparisons.
== Possible Methods to Prevent Directory Traversal ==
A possible algorithm for preventing directory traversal would be to:
* Process URI requests that do not result in a file request, e.g, executing a hook into user code, before continuing below.
* When a URI request for a file/directory is to be made, build a full path to the file/directory if it exists, and normalize all characters (e.g, %20 converted to spaces).
* It is assumed that a 'Document Root' fully qualified, normalized, path is known, and this string has a length N. Assume that no files outside this directory can be served.
* Ensure that the first N characters of the fully qualified path to the requested file is exactly the same as the 'Document Root'.
* If so, allow the file to be returned.
* If not, return an error, since the request is clearly out of bounds from what the web-server should be allowed to serve.
== See also ==
* [[Chroot|Chroot jails]] may be subject to directory traversal using if the chroot jail is incorrectly created. Possible directory traversal attack vectors are open [[file descriptor]]s to directories outside the jail. The [[working directory]] is another possible attack vector.
== Resources ==
* [http://www.owasp.org Open Web Application Security Project]
* [http://www.webappsec.org/projects/threat/classes/path_traversal.shtml The WASC Threat Classification - Path Traversal]
== External links ==
*Conviction for using directory traversal. [http://www.theregister.co.uk/2005/10/05/dec_case/] [http://comment.zdnet.co.uk/0,39020505,39226981,00.htm]
* [http://seclists.org/lists/bugtraq/2000/Oct/0264.html Bugtraq: IIS %c1%1c remote command execution]
* Cryptogram Newsletter July 2000 [http://www.schneier.com/crypto-gram-0007.html].
*[http://www.armorize.com/resources/vulnerability.php?rdChart=Chart1&Keyword=Directory+traversal&dbxCategory=ALL_Category&dbxYear=ALL_Year&dbxLanguage=ALL_Language&Submit=Search Known directory traversal vulnerabilities since 2000] by Armorize Technologies
[[Category:Web security exploits]]
[[Category:Security exploits]]
[[de:Directory Traversal]]
[[ja:ディレクトリトラバーサル]]