Path Traversal

HighNetwork & InfrastructureA01:2021 – Broken Access Control

An attacker manipulates file path parameters using sequences like `../` to access files and directories outside the intended scope, including sensitive system files.

Immediate Response

1Block requests containing path traversal patterns at the WAF immediately.
2Audit server logs to determine which files may have been accessed.
3Assess whether any accessed files contained credentials, keys, or sensitive configuration.

Short-term Remediation

All playbooks

Long-term Prevention

1Use SAST rules to detect file path construction using user input.
2Conduct regular penetration tests targeting file access endpoints.
3Containerize the application to minimize the impact of any path traversal vulnerability.
4Store user-accessible files in a dedicated, isolated blob storage service rather than the filesystem.

Attack vectors

File download/upload endpoints accepting user-controlled path parameters
Template or include directives using unvalidated filenames
Zip Slip: malicious archive entries with path traversal in filenames
URL-encoded or Unicode-encoded traversal sequences bypassing basic filters

Indicators of compromise

Requests containing `../`, `..\`, or encoded equivalents (%2e%2e%2f) in path parameters
Access to files outside the web root in server logs
404 or 200 responses to requests for system files like /etc/passwd or windows/system32

Tooling

OWASP ZAPBurp SuiteSemgrepNuclei