header("Content-type: text/css; charset: UTF-8");

$var = $_GET['var'];
$var = str_replace(array('/', '../'), array('', ''), $var);

echo file_get_contents($var);

Is it possible to exploit Path Traversal without using forward slash?

In other words, would this code be enough to prevent Path Traversal?

$var = str_replace(array('/', '../'), array('', ''), $var);
  • If Yes:

    1. What about backward slash? is it safe?
    2. Would double encoding and hex encoding have any affect on that?
  • If No:

    1. How would you rate it impact?
    2. What is your suggestion for a better solution?

PS: Operation System: Linux

  • Do you mean directory traversals in general or LFI in particular? Also, it matters how the path in $var is handled. Is it just fed into fopen() - or maybe even system()? That's important to know since paths might be expanded (e.g. ~), or you might be on a system where paths work differently (e.g. backslashes on Windows). – Arminius Jun 29 '17 at 0:08
  • @Arminius I have updated my question, check above – Abdelhafidh Belalia Jun 29 '17 at 14:56
  • Well, it's definitely an XSS vulnerability. – Arminius Jun 29 '17 at 16:49
  • @Arminius No, it's not, this is LFI vulnerability. – Abdelhafidh Belalia Jun 29 '17 at 19:00
  • Your example 100% creates an XSS flaw. – Arminius Jun 29 '17 at 19:53

Edited : Yes , I really missed the point of the question sorry for that .Forward slash filtering will prevent LFI in Linux but it won't in Windows-based servers . And LFI can lead to RCE I did that many times but it's another argument .

So you are safe if you are using Linux as you said but if someone used your script in Windows it easily bypassed by (..) backward slash .

The double encoding trick and hex won't work in this situation since you show the file after filtering .

That's all what I know .

  • It is unclear to me how this answers the question – schroeder Jun 29 '17 at 15:22
  • No, Simply No. LFI is not as RCE, and you can't exploit RCE using LFI else the header is set to serve a php file, and the it depends on the command that handle the user input; file_get_contents will not cause RCE. btw you have not answered my question yet. – Abdelhafidh Belalia Jun 29 '17 at 15:26
  • @AbdelhafidhBelalia edited . – Abdullah Hussam Jun 29 '17 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.