3

I ran a SAST Analysis on a project I'm working on and the tool reports the following snippet as a Relative Path Traversal vulnerability (CWE-23):

[Authorize]
[HttpPut("exists")]
public async Task<IActionResult> FileExists([FromBody] string path) {
            return (await Task.FromResult(_storageProvider.FileExists(path))) ? Ok() : BadRequest();
}

The CWE Definition states:

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

I get that a malicious user is able to pass an arbitrary path to this enpoint, but considering that the contents of the file are not rendered to the user, can this still be considered a Path Traversal vulnerability?

1
  • 3
    I'd say yes, this is a variant of path traversal, although obviously the impact is less than arbitrary file reading/writing.
    – paj28
    Apr 14, 2023 at 16:13

1 Answer 1

7

Here there are two different aspects.

  1. CWE-23 is called "Relative Path Traversal", not "Path Traversal". This is important. This description means the essence of the problem. See how MITRE defines CWE-23:

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Also CVE Details uses similar definition.

Your example shows a security problem, the path is not validated. But this example is not quite correct. Namely, the request part is not shown. If the request is like "../../resource", then this would be path traversal problem, otherwise not.

  1. About rendering contents: It is arguable. There is an opinion that disclosure of any information about the system that is not a part of the application logic can be potentially used to attack the system and should be avoided. From this point of view even knowing if some file or directory exists is already a security issue. Another opinion is that the system structure should not be considered as a security factor and important is, if one can read the contents. E.g. many systems have file "/etc/passwd" and knowing this fact is not a risk at all, only disclosing its contents is a security problem, because it may help the attacker.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .