Contents
V5332. OWASP. Possible path traversal vulnerability. Potentially tainted data might be used to access files or folders outside a target directory.
The analyzer has detected that data from an external source is used as file or folder paths without prior validation. This makes the application vulnerable to path traversal attacks.
This attack can be categorized under the OWASP Top 10 Application Security Risks classification as follows:
Path traversal attacks allow attackers to read, record, or delete files outside the target directory by processing the user input with special characters (for example, ..). As a result, attackers can gain access to sensitive data—passwords, keys, and configurations—or disrupt the application. For more details about the vulnerability, refer to the terminology.
The example:
HttpServletRequest request;
HttpServletResponse response;
void write(Path userdir) throws IOException {
....
String userFileRelativePath = request.getParameter("relativePath");
Path fullPath = userdir.resolve(userFileRelativePath);
String content = Files.readString(fullPath);
....
response.getWriter().write(content);
}The method sends the contents of some file from the specified user folder. Users are expected to access only the files stored within this specified directory.
An externally supplied value from request.getParameter is used as a relative path without validation. This creates a path traversal vulnerability, enabling attackers to access the contents of any files on the system.
For example, each user's folder may contain the userInfo.xml file that stores various sensitive data. Assume the code is executed on Windows. In this case, attackers can pass the following string to request.getParameter("relativePath") to access admin user's data:
..\admin\userInfo.xmlTo protect against such attacks, simply checking whether the path starts with .. is insufficient. For example, the following string could also access the same sensitive data:
someFolder\..\..\admin\userInfo.xmlAdditionally, attackers could pass the absolute path instead of the relative one. If the Path#resolve argument is the absolute path, the original one will be completely ignored. For example, the method can be called as follows:
userdir.resolve("C:\\Users\\Admin\\secret.txt");As a result, they get the path: C:\Users\Admin\secret.txt. Thus, the lack of input validation allows attackers to access any file on the system. For more details about path traversal attacks and their descriptions, refer to the official OWASP website.
To protect against path traversal attacks, ensure the target path remains within the base directory. In the example above, it is recommended to use the normalize() method to convert the path into its original form—resolving relative traversals like .. and ., and redundant separators.
After that, the path should be validated via startsWith(userdir). This prevents access to files outside the target directory, even if the path contains masked relative traversals like someFolder\..\..\..\admin\userInfo.xml.
HttpServletRequest request;
HttpServletResponse response;
void write(Path userdir) throws IOException {
....
String userFileRelativePath = request.getParameter("relativePath");
Path fullPath = userdir.resolve(userFileRelativePath);
if (fullPath.normalize().startsWith(userdir)) {
String content = Files.readString(fullPath);
....
response.getWriter().write(content);
} else {
....
}
}This diagnostic is classified as:
Was this page helpful?
