What Are Path Manipulation Vulnerabilities?

Path manipulation vulnerabilities allow attackers to access files and directories outside the designated Webroot folder. By altering the path or parameters used by the application for file access or rendering, attackers can exploit this vulnerability. They may manipulate the path using the "../" sequence or its URL-encoded form when there is insufficient input validation on the parameters that fetch files. Consequently, attackers can access sensitive files, such as website source code or system files.

Why Do Path Manipulation Vulnerabilities Occur?

These vulnerabilities typically arise when an application accepts file paths as user input without any validation. For example, consider the following code snippet where the application takes a filename as input and appends ".txt" to it before accessing the file:

User_File = new FileInputStream(cfg.getProperty("sub")+".txt");

User_read = User_File.read(arr);

out.println(arr);

Without input validation on the filename, an attacker can manipulate the file path and gain access to sensitive information stored on the server. If the application runs with elevated privileges, malicious users could potentially view all server files. Techniques such as null byte injection can bypass the ".txt" suffix, enabling attackers to retrieve files outside the web root directory.

How Can These Vulnerabilities Be Exploited?

Consider an application hosted at "example.com" that retrieves images using a filename parameter:

<img src="/fetch_image.php?filename=1.png">

The images are stored in the directory /var/www/images/, and the application fetches the image as follows:

/var/www/images/logo.png

If there is no validation on the "filename" parameter, an attacker can exploit this by modifying the path, such as:

This alteration grants direct access to sensitive files. Furthermore, attackers can use the dot-dot-slash (../) notation to escape directory restrictions. For instance, an attacker could supply the following parameter to access files outside the webroot:

This command allows the attacker to navigate up three directories from /var/www/images and access sensitive files in the /root directory.

Bypassing LFI Protections with PHP Wrappers

If developers implement checks against the "../" notation, the application may block attempts and return an error message. However, attackers can circumvent these defenses using PHP wrappers. When a relative path lacking "../" or a Windows drive letter is supplied, the PHP wrapper applies the provided path against its current working directory. Thus, the attacker can use the following input:

This payload forces PHP to base64 encode the specified file before rendering it on the user interface.

Preventive Measures Against Path Traversal Vulnerabilities

To mitigate the risk of path traversal vulnerabilities, developers should:

1. Whitelist accessible files.
2. Utilize filesystem calls for functions without user input.
3. Sanitize user input to exclude any instance of [../].
4. Validate user input for syntax, length, and other parameters.
5. Enforce strict access control policies to restrict access to sensitive directories.