3

I'm currently reading a security audit of a web application where they rank relative paths in a web application as a security risk.

e.g.:

<a href=../contact.html>Contact</a>

I found several information on this topic regarding SEO. But I can't think of a scenario where this could be a security issue.

1
  • 1
    Not a full fledged answer, but I would call it a red flag rather than an explicit risk. On its own it's not a risk, but relative paths are often a red flag that the developers did not take path traversal attacks into consideration when building the app.
    – loneboat
    Oct 10, 2018 at 13:48

3 Answers 3

1

Relative URLs can be vulnerable to Relative Path Overwrite.

The main idea is that the client and the server will both parse the URL differently, so they might define the current directory differently.

For example, imagine you have a page located at /forum/index.php. Let's craft a simple URL which will be parsed differently by the client and the server: /forum/index.php/.

  • The server will see /forum/index.php, and / will parsed as the path info by an Apache webserver. It will define the current directory as /forum/
  • The client has no way to know that index.php is not a directory, so it will define the current directory as /forum/index.php/

This allows you to redirect the intended location of a link, or a source of a stylesheet / script, allowing you to escalate to more advanced attacks like XSS.

3
  • So what you are saying is that the content of the HTML allows you to subvert the site. But the content is sent to the client and hence can be changed by the client.
    – symcbean
    Nov 9, 2018 at 12:16
  • @symcbean: reflected & DOM-based XSS can also be changed by the client, but those are still vulnerabilities. Nov 9, 2018 at 12:51
  • 1
    if an otherwise secure application is deployed in a path below an application where an attacker can control the content, or an attacker can control content within the application then what you describe can be used to leverage an attack. It is NOT in itself the vulnerability. If you still want to argue about this then go search the CVE database; this behaviour has been present in Apache for over 20 years.
    – symcbean
    Nov 9, 2018 at 13:13
0

If someone tells you something is wrong, then they must be able to tell you why its wrong. And using relative links has no impact on SEO with any of the major search engines (at least for the last 10 years).

If someone infers from the presence of relative URLs in HTML that the service is vulnerable to path traversal attacks, then they are in the wrong job.

  • in the normal course of events, these are converted to canonical paths in the client
  • it is considered good practice from a development point of view to use relative paths such that an application can be deployed in a multi-tenant vhost and for code management

I am not saying that the application is not vulnerable - but there is nothing in the question to support this assertion.

While proving in a double-blind test that an application is not vulnerable to path traversal attacks, it should be trivial for a competent systems admin to deliberately conitrive a staged scenario (files with appropriate permissions in a known path outside the application path) to test.

-1

I believe it might have to do with the path traversal attack. Which means, someone might replace the relative path to that file with the relative path to another one which could be:

  • another file from that server containing sensitive information so in this way they could have access to the contents of that file and they could read it
  • another file from a remote server and if the server that stores your application tries to load a file from the relative path you specified, it will load instead this file from the remote server, which could contain some malware or another form of attack

They could also use this vulnerability exactly for path traversal, which means, they would change that path to parent folders and so on upper in folders hierarchy and load every possible file they found there. In this way, they will gain information about absolutely every file you store on that disk.

1
  • 1
    This doesn't make sense though; relative paths in URLs are handled by the browser; they don't necessarily indicate that a path transversal attack is possible.
    – Ajedi32
    Oct 10, 2018 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .