路径遍历 Path Traversal

1. 📌 Topic Summary

This document explores the core mechanisms and defense strategies of Path Traversal (also known as Directory Traversal) vulnerabilities. It provides a detailed analysis of various bypass techniques under different defense mechanisms (such as absolute path blocking, non-recursive filtering, URL decoding, and prefix/suffix validation) through six practical labs.

2. 🧠 Core Principle

Underlying Mechanism: A path traversal vulnerability arises when a web application directly concatenates user-supplied input (e.g., a filename) into a server file path and passes it to underlying filesystem operations without rigorous security validation. Attackers exploit the operating system's directory parsing rules by inputting special directory traversal sequences (e.g., ../ on Unix/Linux or ..\ on Windows). This causes the parsed path to "break out" of the application's designated base directory, allowing access to the filesystem root and other arbitrary file locations.

Terminology:

• Path Traversal / Directory Traversal - Path traversal/directory traversal vulnerability.
• API - Application Programming Interface. Here, it refers to the low-level functions provided by the operating system for reading and writing files.
• URL - Uniform Resource Locator.
• PoC - Proof of Concept (code/payload demonstrating the vulnerability).
• RCE - Remote Code Execution (AI supplementary note: refers to attackers executing arbitrary system commands on the target server, typically the final impact of file write or inclusion vulnerabilities).

3. 🛠️ Usage & Examples - How to Exploit

Common Scenarios: Frequently occurs in scenarios where resources are dynamically loaded via URL parameters, such as an e-commerce site's product image endpoint: https://insecure-website.com/loadImage?filename=218.png.

Specific Examples & PoCs (Combined with Practical Labs): The following summarizes specific attack payloads for reading the standard Linux user information file /etc/passwd under various security defense scenarios:

Code/Function Analysis:

• File (Java Class): An abstract representation of file and directory pathnames. For example, new File(BASE_DIRECTORY, userInput) is used to concatenate a base directory with user input.
• getCanonicalPath() (Java Method): Returns the canonical pathname string. This method resolves all relative path symbols like ../ and ./, as well as symbolic links, ultimately returning the real absolute path of the target file. It is a core function for defending against path traversal.

4. ⚠️ Risk & Impact

If this vulnerability is successfully exploited, it can lead to extremely severe consequences for the system:

• Sensitive Information Disclosure: Attackers can read application source code, database credentials, and sensitive backend system configuration files (e.g., Linux's /etc/passwd or Windows's win.ini).
• Business Data Tampering: If the application has both read and file write vulnerabilities, attackers can modify application data or system configuration files.
• Complete System Compromise (AI supplementary note): Attackers can achieve RCE and fully control the server by writing SSH keys, overwriting scheduled tasks (Cron jobs), or uploading WebShells.

5. 🛡️ Defense & Mitigation

The most effective defense strategy is to completely avoid passing user-supplied input directly to underlying filesystem APIs. If business logic makes this unavoidable, a dual-layer defense mechanism must be implemented:

1. Strict Input Validation:
2. Path Canonicalization & Base Directory Verification:

// 1. Concatenate user input with the base directory
File file = new File(BASE_DIRECTORY, userInput);
// 2. Get the canonical absolute path and verify it does not escape the secure directory
if (file.getCanonicalPath().startsWith(BASE_DIRECTORY)) {
    // process file (safe, file can be processed)
} else {
    // Deny the request and log a security event
}

1. Principle of Least Privilege (AI supplementary note):

• Ensure the service account running the web application (e.g., www-data) has only read permissions for necessary directories (e.g., /var/www/images/). Never grant access permissions to system-level directories (e.g., /etc/).