1

Currently I am working in code review process. I have few doubts regrading Path Manipulation Vulnerability. Some portion of the Path is already hard coded and with extension

public class ReadFile {

    public static void main(String args[]) throws IOException {
            String fname=args[0];
        fname="C:\\Users\\kutrivedi\\Desktop\\Ref\\"+fname+".txt";

        BufferedReader br = new BufferedReader(new FileReader(fname));
        for (String line; (line = br.readLine()) != null;) {
            System.out.print(line);
        }
        br.close();
    }
}

Questions:

1) Exploitation is Possible ?

2) If yes than How attacker exploit that functionality ?

3) Is there any payload to go to the back directory when directory wrote by developer ?

Thanks in advanced

  • 1
    With the example that you post, the response is yes, if you give value to the variable fname = "../../../pepe/Desktop/Ref/somefile.txt" then your path will be compromise. There is a lot of examples of how to mitigate and program correctly in order to avoid these issues – camp0 Aug 5 '19 at 9:57
  • @camp0 Thanks for your response can you please elaborate your answer for better understanding – useradmin1234 Aug 5 '19 at 10:00
4

Is it possible to exploit this code?

Yes.

How can an attacker exploit this?

Path Traversal Vulnerabilities allow an attacker to choose a file that is not intended by the developer.

For example, your program has the path "C:\\Users\\kutrivedi\\Desktop\\Ref\\" + input + ".txt" hardcoded. If I entered foo as input, then the resulting file would be C:\\Users\\kutrivedi\\Desktop\\Ref\\foo.txt.

Of course, I could add more than just one word, such as foo\\bar, which would result in the following file being read instead: C:\\Users\\kutrivedi\\Desktop\\Ref\\foo\\bar.txt

So just by adding \\, I can traverse deeper into the file structure.

Can an attacker traverse the file system up?

I can do that too, with the pseudo-directory ... Every directory has a pseudo-entry called .., which points to the parent. As such, if I enter ..\\foo, then the following path is created C:\\Users\\kutrivedi\\Desktop\\Ref\\..\\foo.txt, which will be resolved to C:\\Users\\kutrivedi\\Desktop\\foo.txt.

For example, if my payload is ..\\..\\..\\..\\foo, then I would now read C:\\foo.txt.

I could go further and print arbitrary files, as long as they had a .txt extension. Since this code was presumably written in Java, and Java does not terminate strings with a \0 character, there is no easy way to terminate the string earlier to skip the extension.

If, however, your programming language was built on null-terminating strings, my payload could read arbitrary files too, as long as the process had permission to read them:

..\\..\\..\\..\\Windows\\System32\\config\\SAM\0 will result in C:\\Windows\\System32\\config\\SAM.

How can this be fixed?

The easiest way is to use a library or built-in framework, which deals with paths. Most libraries have checks to see if something is inside or outside a directory structure, so you can use those checks to see if the payload you are getting is trying to access a file it shouldn't.

|improve this answer|||||
  • Thank You so much @MechMK1 – useradmin1234 Aug 5 '19 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.