Path traversal via filename

Question

Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames?

For example, naming a file "../test.txt" (if it's possible at all) and uploading it to a website. If the website does not validate the filename, it could save the file to the parent directory instead (assuming folder permissions allow this).

Answer 1

You wouldn't be able to name a file ../test.txt as no filesystem (that I'm aware of) allows forward slashes within the filename. (Certainly all POSIX filesystems do not.)

That being said, for an attacker, it doesn't matter. The filename is sent as part of the HTTP POST data, which is of course subject to tampering by an attacker:

--------------------------d74596066958873e
Content-Disposition: form-data; name="formfield"; filename="file.txt"
Content-Type: text/plain

filecontents
--------------------------d74596066958873e

So an attacker can easily specify something other than "file.txt" for the filename field. Whether your application server or application code will accept a filename containing is what will determine if you are vulnerable to a directory traversal via the filename.

Answer 2

The file name ../file.txt is not possible, but as the topic is path traversal via file name there is another technique to do that.

If you are using cURL then it's possible:

curl Your-URL -F "[email protected];filename=../../key.txt"

Here the first #filename is local file name and the second #filename is a HTTP request. This is a quick way to test path traversal in a file upload functionality.

Answer 3

yes it is possible, in any linux machine you can name any file anything you want including special characters!

In hackerone there is a ctf that includes path traversal in file upload.