I have an instance where we have an application that requires the ability to set up sftp commands that are specified by administrative users. They are configured through the front-end of the application. Veracode has correctly identified a directory traversal attack here.
I work for a B2B company, and this sftp process is for our clients to send/receive files specifying directory structures on their own system.
The connection is handled through an API and the current library correctly escapes data as input (i.e. if I send "../ && rm * " it gets treated as a directory to "cd" to. The target file to be copied IS controlled explicitly by the system--but that doesn't mean its always the case.
But short of blacklisting certain directories paths like "../" I'm lost as to other strategies at the application level I can possibly use to prevent this attack.
I might have miscommunicated: The issue is that our application runs on our servers as its own instance. Chroot jails is fine on our end, but what about the client's server? The business logic is that we'll deposit file(s) to a directory on a system they specify. We have no control over that, and they should have the flexibility to be able to specify precisely what directory they want our application to deposit their files.
I don't like blacklisting approaches because you never know what you missed. And in theory, this process could be set up to point to a Windows box instead of a unix box, and then there's two sets of blacklist rules you suddenly have to code for--not to mention environment detection on the remote server.