# Path Manipulation Vulnerability

Currently I am working in code review process. I have few doubts regrading Path Manipulation Vulnerability. Some portion of the Path is already hard coded and with extension

public class ReadFile {

public static void main(String args[]) throws IOException {
String fname=args[0];
fname="C:\\Users\\kutrivedi\\Desktop\\Ref\\"+fname+".txt";

for (String line; (line = br.readLine()) != null;) {
System.out.print(line);
}
br.close();
}
}


Questions:

1) Exploitation is Possible ?

2) If yes than How attacker exploit that functionality ?

3) Is there any payload to go to the back directory when directory wrote by developer ?

• With the example that you post, the response is yes, if you give value to the variable fname = "../../../pepe/Desktop/Ref/somefile.txt" then your path will be compromise. There is a lot of examples of how to mitigate and program correctly in order to avoid these issues – camp0 Aug 5 '19 at 9:57

Is it possible to exploit this code?

Yes.

How can an attacker exploit this?

Path Traversal Vulnerabilities allow an attacker to choose a file that is not intended by the developer.

For example, your program has the path "C:\\Users\\kutrivedi\\Desktop\\Ref\\" + input + ".txt" hardcoded. If I entered foo as input, then the resulting file would be C:\\Users\\kutrivedi\\Desktop\\Ref\\foo.txt.

Of course, I could add more than just one word, such as foo\\bar, which would result in the following file being read instead: C:\\Users\\kutrivedi\\Desktop\\Ref\\foo\\bar.txt

So just by adding \\, I can traverse deeper into the file structure.

Can an attacker traverse the file system up?

I can do that too, with the pseudo-directory ... Every directory has a pseudo-entry called .., which points to the parent. As such, if I enter ..\\foo, then the following path is created C:\\Users\\kutrivedi\\Desktop\\Ref\\..\\foo.txt, which will be resolved to C:\\Users\\kutrivedi\\Desktop\\foo.txt.

For example, if my payload is ..\\..\\..\\..\\foo, then I would now read C:\\foo.txt.

I could go further and print arbitrary files, as long as they had a .txt extension. Since this code was presumably written in Java, and Java does not terminate strings with a \0 character, there is no easy way to terminate the string earlier to skip the extension.

..\\..\\..\\..\\Windows\\System32\\config\\SAM\0 will result in C:\\Windows\\System32\\config\\SAM.