4

I've recently come across this blog post of a bug bounty hunter.

Apparently, a path traversal vulnerability was discovered, which looked like this:

 http://help.example.com/@app/skin/views/%5c../%5c../%5c../%5c../%5c../%5c../%5c../etc/passwd.html

I've never come across such a format for a path traversal.

How does this work and what is the purpose of the URL encoded backslash in %5c..?

6

"%5c" (encoded backslash) is commonly used to circumvent sanitisation of the "../" (forward slash) in a URL - tries to stop directory transversal via the URL. As you can't have a backslash in a URL it needs to be encoded.

So if the forwardslash is blocked the backslash may work - allowing the attack.

I've seen this more often on IIS attacks rather than Linux/Unix servers.

  • 1
    So this is basically a circumvention of ../ filtering? – Breakfast Serial Jun 28 '17 at 5:52
  • 1
    Yes. Another way of trying to move up a directory. If forward slash is stripped then make use of the backslash as most basic protection methods block ../ – ISMSDEV Jun 28 '17 at 5:53
  • 1
    @BreakfastSerial Yes, I suspect an attempted bypass of ../ filtering. However, from its position, the (URI-encoded) backslash (0x5c) is more likely to be "protecting" the first of the dots (.) following it than the forward slash. Although it may work on some sites, the fact that ../ is still present "in plain text" suggests it won't be very effective against sites that have some protection. A better attack might be .../.%5c./.%5c./... -- i.e. putting the backslash between the two dots so ../ is no longer directly visible. – TripeHound Jun 28 '17 at 11:11
  • can such attacks be prevented by mvc patterned web framework like laravel, spring – Samim Apr 25 '18 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.