Knock Knock… Who Let the Hacker In? Path Traversals

Path traversal vulnerabilities—aka directory traversal attacks—are like that one nosy neighbor who tries to peek into rooms they weren’t invited to.

Path traversal vulnerabilities, also known as directory traversal attacks, attempt to gain access to and read files in a restricted directory by manipulating variables that reference file paths. It occurs on the web server outside the website's directory. This type of attack is wholly an attempt to get access to sensitive

data to use in other attacks and can include application code and data, credentials, and sensitive system files.

How does this happen, and what are the risks? It starts innocently enough—an attacker impersonates a legit user, sweet-talks the web server, and convinces it to hand over files that are definitely not in the web root folder.

The attacker can hack or impersonate one of our users and trick the web server (or application) into returning files not in the web root folder. Boom! Now the bad actor has access to sensitive information and can steal our data, or even worse. They could have access to credentials, private files, or even the server's diary. They can also attempt to gain full control of the server and expose more vulnerabilities. Can it get worse? Oh yes. They can also reveal source code or poke around system programs, which can further compromise the system.

Defending Your Website Like a Cybersecurity Ninja:

• First things first: Use a trusty web vulnerability scanner to crawl the website and perform these checks like a nosy detective with a magnifying glass!

• Simple enough, a first line of defense is to ensure you have the latest version of your web server software installed and patches applied. Outdated servers are basically open invitations to hackers—like leaving your front door wide open.

• User Input and File System APIs: Avoid using user-supplied input directly with file system APIs. Never trust user input blindly-validate! .If necessary, validate input strictly against a whitelist of permitted values or patterns. (Only whitelisted values make it in).

• When making file system calls, treat user input like a suspicious package. Minimize the use of user input in file system operations. Prefer using known, safe files and validate any user-specified paths to ensure they only access permitted areas. Double-check paths like your system’s life depends on it—because it kinda does.

• Storage of Sensitive Files: Do not store sensitive or configuration files in the web root directory to avoid unauthorized access. That's a hard no. Don't leave your diary out in the open where company can find it.

• Finally, implement restrictions on where files can be saved or retrieved from within the application to enhance security. Think of it as baby gates around your house.

That's my take on path traversals.