CompTIA Security+ - Directory Traversal Attack examples

 Directory Traversal Attack

Here’s what you need to know about directory traversal for the exam, written out below the video:

What Is a Directory Traversal Attack?

A directory traversal attack (also called path traversal) tricks a web application into reading, and sometimes writing, files outside the folder it’s supposed to be limited to. It happens when an application takes a filename or file path from user input — a URL parameter, a cookie, an upload field — and uses it to build a path on the file system without properly checking where that path actually points. It rounds out the application-attacks trio alongside XSS and SQL injection on the Security+ exam, but instead of targeting a browser or a database, it targets the file system itself.

How the Attack Works

  • Dot-dot-slash sequences – The classic version. Each ../ climbs one level up the directory tree, so a string of them can walk all the way out of the intended web folder and down into system files, like requesting an image parameter but substituting ../../../../etc/passwd to pull the server’s password file instead.
  • Encoding tricks – To slip past basic filters, attackers URL-encode the sequence (%2e%2e%2f for ../), double-encode it, or use Windows-style backslash variants (..%5c). Some filters that only block a plain ../ string can still be fooled by patterns like ....//, which turns into ../ once the filter strips the inner dots.
  • Absolute path injection – If the application just appends user input onto a base folder, supplying a full path outright can override the intended location entirely.
  • Null byte injection – An older trick where a %00 terminates a filename at the operating-system level, letting an attacker smuggle a different file extension past a validation check that only looks at the end of the string.

What an Attacker Can Actually Do With It

  • Read configuration files, source code, and credential files the application was never meant to expose
  • Pull operating-system files to map out the target for further attacks
  • On a Linux system, potentially traverse across the entire disk; on Windows, traversal is usually confined to the drive holding the web root, though that’s a limit, not a guarantee of safety
  • In more severe cases — especially when combined with the ability to write or execute files — escalate all the way to remote code execution on the server

Real-World Example

CVE-2021-41773, disclosed in Apache HTTP Server 2.4.49, is one of the most cited directory traversal flaws in recent memory. It let unauthenticated attackers read files outside the document root with a crafted request, and on servers with CGI scripts enabled, the same flaw could be chained into full remote code execution. It was being actively exploited within hours of public disclosure, and the first patch (2.4.50) was found to be incomplete, requiring a second CVE (2021-42013) to fully close the hole.

How to Defend Against Directory Traversal

  • Avoid using raw user input in file operations – Where possible, don’t let user input determine a file path at all.
  • Use an index or allow-list instead of a filename – Map user input to a known-good value (like a numeric ID) on the server side rather than accepting a path or filename directly.
  • Canonicalize before use – If user input must contribute to a path, normalize/resolve it first and confirm the final, resolved path still falls inside the intended directory before opening it.
  • Sandbox the application – chroot jails and similar OS-level restrictions limit what the process can reach even if a traversal sequence gets through.
  • Keep sensitive files outside the web root – Configuration files and credentials shouldn’t be reachable even if traversal succeeds.
  • Patch web servers and frameworks promptly – As CVE-2021-41773 showed, these flaws get weaponized within hours once disclosed.

Security+ Exam Tip

If a question shows a URL or input field with repeated ../ sequences (or an encoded variant like %2e%2e%2f) aimed at reaching a file like /etc/passwd or a config file, that’s directory traversal — not XSS (which injects script for the browser) and not SQL injection (which targets the database). The term to remember for the fix is canonicalization: resolving a path to its true, absolute form and verifying it’s still inside the allowed directory before the file is ever touched.

Key Takeaways

  • Directory traversal manipulates file paths to reach files outside the application’s intended folder, most often using ../ sequences or their encoded equivalents.
  • It can expose source code, configuration files, and credentials — and in severe cases escalate to remote code execution.
  • CVE-2021-41773 in Apache HTTP Server is a textbook real-world example, exploited within hours of disclosure.
  • The core defense is canonicalizing and validating any path before using it, ideally by avoiding user-controlled file paths altogether.

Comments

Post a Comment