0

If my websites has a directory traversal vulnerability (linux) and my other php pages have complicated filenames (e.g. efj93ehdsijgdij3g.php), could an attacker still access other files? Or an attacker strictly needs the right filename in order to successfuly conduct a directory traversal?

  • 1
    It depends, in most cases yes. However there are lots of other files an attacker would look at rather than your pho files, such as /etc/shadow. If your directory traversal is used in an include() you have a lfi vulnerability and again there are easier targets such as /proc/self/environ. Should an attacker succeed with exploitation of lfi your file name complexity no longer matters. – wireghoul Feb 28 '16 at 19:39
  • Seems right (and I am using the include() funct) but could you expand about the cases in which they can exploit the directory traversal or what depends? – worldends Feb 28 '16 at 19:42
  • Expanded on my comment as an answer.. – wireghoul Feb 28 '16 at 21:39
2

Directory traversal is a rather broad vulnerability that can lead to a variety of attacks, depending on context.

On its own, it only means that an attacker supplies a file or directory name, and can travers to files or directories outside of the expected directory. This can facilitate attacks such as:

  • LFI
  • Reading of files outside of the desired directory
  • Uploading files outside of the desired directory, possibly leading to code execution (for example if the only thing preventing code execution is securing the desired directory)
  • moving files outside of the desired directory
  • Viewing directories outside of the desired directory, which may help an attacker gather information about the target system
  • etc

Giving your files complicated filenames could only possibly help in the case of reading out files outside of the directory, and only if you do not provide the ability to list files.

Renaming your files may seem like a good idea as defense in depth - security by obscurity should never be your only line of defense -, but it's not really worth it, as there are larger attack surfaces than reading out your PHP files.

In the case of LFI, an attacker can still read out system files which can have severe consequences. Depending on your configuration, they may be able to:

  • read out /etc/shadow, crack the passwords, and gain access to the system
  • inject code into various log files and include them, leading to code execution
  • inject code into proc/self/environ and include it, leading to code execution
  • etc

So renaming files may prevent an attacker from reading out those specific files, but doesn't really limit the damage of LFI. It also leads to reduced maintainability, making it not worth the trouble.

1

Having to know the file name depends upon the vulnerable code, sometimes you can get directory listings. However there are lots of other files an attacker would look at rather than your php files, such as /etc/shadow.

If your directory traversal is used in an include() statement you have a rfi or lfi vulnerability and again there are easier targets such as setting the user-agent to <?php passthru($_GET['c]); ?> and traversing to /proc/self/environ or your web server logs. Or any other location where the attacker can control content written on your hard drive (uploaded files, temporary files, session files, database files, smtpd/sshd logs, etc, etc). Should an attacker succeed with exploitation of lfi your file name complexity no longer matters as an attacker could just run commands like ls to list files.

A good way to prevent traversal attacks is to compare the user supplied data against an array of acceptable values, or simply call basename() on the user supplied data prior ot the include() as long as there is no user (attacker) controlled files in the same directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.