0

I was reading owsap top 10 for Web Applications and it comes with File Path Traversal Vulnerability and when i deep looking to it i got it a vulnerability for only reading files from a server and when it comes to write files it called then local file include.

but when i saw these vulnerability:

Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE) 

https://www.exploit-db.com/exploits/50406

it confused me, so does Path Traversal write files or it needs special conditions?

2 Answers 2

1

when it comes to write files it called then local file include.

Local file include does not require writing files nor does it mean that writing files will be possible. It only means that the server side application can be tricked into including (and executing) code into the running application from files which are already local to the server. How the local file was placed on the server is a different thing, it might be already there and can be misused for a different purpose or it might be for example send to the server by using some file upload feature in the application.

does Path Traversal write files

Path traversal just means that the application can be tricked into accessing files it should not be allowed to by traversing the path using features like upper directory (i.e. "..") to something outside the allowed directory. The classification as path traversal does not include a specific limitation of which kind of access is possible.

Most path traversal attacks only allow read access, i.e. information leakage. But depending on what the server does with the file it might be write access too. Or it might even be the ability to execute the file as in the case of the vulnerability you describe. To cite from the analysis done by Qualys Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013):

While CVE-2021-41773 was initially documented as Path traversal and File disclosure vulnerability additional research concluded that the vulnerability can be further exploited to conduct remote code execution when mod_cgi module is enabled on the Apache HTTP server, this allows an attacker to leverage the path traversal vulnerability and call any binary on the system using HTTP POST requests.

0

There are two things here:

  1. The path traversal that in general is where the problem starts. In general web services and other face internet services in general they should abstract and isolate their filesystem out the outside, but because there is a problem of configuration or design on the system you can access to them by using .. and . that refers to current directory and child directory. This allows to the attacker to reach the original file system, in linux the root / and point directly to /bin/bash, for example ../../../bin/bash.
  2. The remote command execution (RCE) in general is because the attacker have access to a remote shell in some way, remember that once you have access to the shell you can write on files, create new ones, downloads other software and so on.

Hope it clarifies your question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .