2

Currently I am working in code review process. I have few doubts regrading Path Manipulation Vulnerability. Some portion of the Path is already hard coded and with extension

public class ReadFile {

    public static void main(String args[]) throws IOException {
            String fname=args[0];
        fname="C:\\Users\\kutrivedi\\Desktop\\Ref\\"+fname+".txt";

        BufferedReader br = new BufferedReader(new FileReader(fname));
        for (String line; (line = br.readLine()) != null;) {
            System.out.print(line);
        }
        br.close();
    }
}

Questions:

1) Exploitation is Possible ?

2) If yes than How attacker exploit that functionality ?

3) Is there any payload to go to the back directory when directory wrote by developer ?

Thanks in advanced

2
  • 1
    With the example that you post, the response is yes, if you give value to the variable fname = "../../../pepe/Desktop/Ref/somefile.txt" then your path will be compromise. There is a lot of examples of how to mitigate and program correctly in order to avoid these issues
    – camp0
    Commented Aug 5, 2019 at 9:57
  • @camp0 Thanks for your response can you please elaborate your answer for better understanding Commented Aug 5, 2019 at 10:00

1 Answer 1

5

Is it possible to exploit this code?

Yes.

How can an attacker exploit this?

Path Traversal Vulnerabilities allow an attacker to choose a file that is not intended by the developer.

For example, your program has the path "C:\\Users\\kutrivedi\\Desktop\\Ref\\" + input + ".txt" hardcoded. If I entered foo as input, then the resulting file would be C:\\Users\\kutrivedi\\Desktop\\Ref\\foo.txt.

Of course, I could add more than just one word, such as foo\\bar, which would result in the following file being read instead: C:\\Users\\kutrivedi\\Desktop\\Ref\\foo\\bar.txt

So just by adding \\, I can traverse deeper into the file structure.

Can an attacker traverse the file system up?

I can do that too, with the pseudo-directory ... Every directory has a pseudo-entry called .., which points to the parent. As such, if I enter ..\\foo, then the following path is created C:\\Users\\kutrivedi\\Desktop\\Ref\\..\\foo.txt, which will be resolved to C:\\Users\\kutrivedi\\Desktop\\foo.txt.

For example, if my payload is ..\\..\\..\\..\\foo, then I would now read C:\\foo.txt.

I could go further and print arbitrary files, as long as they had a .txt extension. Since this code was presumably written in Java, and Java does not terminate strings with a \0 character, there is no easy way to terminate the string earlier to skip the extension.

If, however, your programming language was built on null-terminating strings, my payload could read arbitrary files too, as long as the process had permission to read them:

..\\..\\..\\..\\Windows\\System32\\config\\SAM\0 will result in C:\\Windows\\System32\\config\\SAM.

How can this be fixed?

The easiest way is to use a library or built-in framework, which deals with paths. Most libraries have checks to see if something is inside or outside a directory structure, so you can use those checks to see if the payload you are getting is trying to access a file it shouldn't.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .