If my websites has a directory traversal vulnerability (linux) and my other php pages have complicated filenames (e.g. efj93ehdsijgdij3g.php), could an attacker still access other files? Or an attacker strictly needs the right filename in order to successfuly conduct a directory traversal?
Directory traversal is a rather broad vulnerability that can lead to a variety of attacks, depending on context.
On its own, it only means that an attacker supplies a file or directory name, and can travers to files or directories outside of the expected directory. This can facilitate attacks such as:
- Reading of files outside of the desired directory
- Uploading files outside of the desired directory, possibly leading to code execution (for example if the only thing preventing code execution is securing the desired directory)
- moving files outside of the desired directory
- Viewing directories outside of the desired directory, which may help an attacker gather information about the target system
Giving your files complicated filenames could only possibly help in the case of reading out files outside of the directory, and only if you do not provide the ability to list files.
Renaming your files may seem like a good idea as defense in depth - security by obscurity should never be your only line of defense -, but it's not really worth it, as there are larger attack surfaces than reading out your PHP files.
In the case of LFI, an attacker can still read out system files which can have severe consequences. Depending on your configuration, they may be able to:
- read out /etc/shadow, crack the passwords, and gain access to the system
- inject code into various log files and include them, leading to code execution
- inject code into proc/self/environ and include it, leading to code execution
So renaming files may prevent an attacker from reading out those specific files, but doesn't really limit the damage of LFI. It also leads to reduced maintainability, making it not worth the trouble.
Having to know the file name depends upon the vulnerable code, sometimes you can get directory listings. However there are lots of other files an attacker would look at rather than your php files, such as
If your directory traversal is used in an
include() statement you have a
lfi vulnerability and again there are easier targets such as setting the user-agent to
<?php passthru($_GET['c]); ?> and traversing to
/proc/self/environ or your web server logs. Or any other location where the attacker can control content written on your hard drive (uploaded files, temporary files, session files, database files, smtpd/sshd logs, etc, etc). Should an attacker succeed with exploitation of lfi your file name complexity no longer matters as an attacker could just run commands like
ls to list files.
A good way to prevent traversal attacks is to compare the user supplied data against an array of acceptable values, or simply call
basename() on the user supplied data prior ot the
include() as long as there is no user (attacker) controlled files in the same directory.