3

I'm currently reading a security audit of a web application where they rank relative paths in a web application as a security risk.

e.g.:

<a href=../contact.html>Contact</a>

I found several information on this topic regarding SEO. But I can't think of a scenario where this could be a security issue.

  • 1
    Not a full fledged answer, but I would call it a red flag rather than an explicit risk. On its own it's not a risk, but relative paths are often a red flag that the developers did not take path traversal attacks into consideration when building the app. – loneboat Oct 10 '18 at 13:48
1

Relative URLs can be vulnerable to Relative Path Overwrite.

The main idea is that the client and the server will both parse the URL differently, so they might define the current directory differently.

For example, imagine you have a page located at /forum/index.php. Let's craft a simple URL which will be parsed differently by the client and the server: /forum/index.php/.

  • The server will see /forum/index.php, and / will parsed as the path info by an Apache webserver. It will define the current directory as /forum/
  • The client has no way to know that index.php is not a directory, so it will define the current directory as /forum/index.php/

This allows you to redirect the intended location of a link, or a source of a stylesheet / script, allowing you to escalate to more advanced attacks like XSS.

  • So what you are saying is that the content of the HTML allows you to subvert the site. But the content is sent to the client and hence can be changed by the client. – symcbean Nov 9 '18 at 12:16
  • @symcbean: reflected & DOM-based XSS can also be changed by the client, but those are still vulnerabilities. – Benoit Esnard Nov 9 '18 at 12:51
  • if an otherwise secure application is deployed in a path below an application where an attacker can control the content, or an attacker can control content within the application then what you describe can be used to leverage an attack. It is NOT in itself the vulnerability. If you still want to argue about this then go search the CVE database; this behaviour has been present in Apache for over 20 years. – symcbean Nov 9 '18 at 13:13
0

If someone tells you something is wrong, then they must be able to tell you why its wrong. And using relative links has no impact on SEO with any of the major search engines (at least for the last 10 years).

If someone infers from the presence of relative URLs in HTML that the service is vulnerable to path traversal attacks, then they are in the wrong job.

  • in the normal course of events, these are converted to canonical paths in the client
  • it is considered good practice from a development point of view to use relative paths such that an application can be deployed in a multi-tenant vhost and for code management

I am not saying that the application is not vulnerable - but there is nothing in the question to support this assertion.

While proving in a double-blind test that an application is not vulnerable to path traversal attacks, it should be trivial for a competent systems admin to deliberately conitrive a staged scenario (files with appropriate permissions in a known path outside the application path) to test.

-1

I believe it might have to do with the path traversal attack. Which means, someone might replace the relative path to that file with the relative path to another one which could be:

  • another file from that server containing sensitive information so in this way they could have access to the contents of that file and they could read it
  • another file from a remote server and if the server that stores your application tries to load a file from the relative path you specified, it will load instead this file from the remote server, which could contain some malware or another form of attack

They could also use this vulnerability exactly for path traversal, which means, they would change that path to parent folders and so on upper in folders hierarchy and load every possible file they found there. In this way, they will gain information about absolutely every file you store on that disk.

  • 1
    This doesn't make sense though; relative paths in URLs are handled by the browser; they don't necessarily indicate that a path transversal attack is possible. – Ajedi32 Oct 10 '18 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.