ABSTRACT

Allowing user input to control paths used in filesystem operations could enable an attacker to access or modify otherwise protected system resources.

EXPLANATION

Path manipulation errors occur when the following two conditions are met:

1. An attacker can specify a path used in an operation on the filesystem.

2. By specifying the resource, the attacker gains a capability that would not otherwise be permitted.

For example, the program may give the attacker the ability to overwrite the specified file or run with a configuration controlled by the attacker.

Example 1: The following code uses input from an HTTP request to create a file name. The programmer has not considered the possibility that an attacker may provide a file name like "..\\..\\Windows\\System32\\krnl386.exe", which will cause the application to delete an important Windows system file.


...
r_name = request->get_form_field( 'report_name' ).
CONCATENATE `C:\\users\\reports\\` r_name INTO dsn.
DELETE DATASET dsn.
...

Example 2: The following code uses registry key sub to determine which file to open and echo back to the user. If the program runs with privileges and malicious users can change the configuration file, they can use the program to read any file on the system that ends with the extension .txt.


...
CALL FUNCTION 'REGISTRY_GET'
  EXPORTING
     KEY   = 'sub'
  IMPORTING
     VALUE = file.

CONCATENATE file `.txt` INTO dsn.
OPEN DATASET dsn.
DO.
  READ DATASET dsn INTO record.
  IF SY-SUBRC NE 0.
    EXIT.
  ELSE.
    WRITE: / record.
  ENDIF.
ENDDO.
...

REFERENCES

[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A1 Unvalidated Input

[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A4 Insecure Direct Object Reference

[3] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A4 Insecure Direct Object References

[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3510 CAT I, APP3600 CAT II

[5] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 22, CWE ID 73

[6] G. Hoglund, G. McGraw Exploiting Software Addison-Wesley

[7] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Path Traversal

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.3.1.1, Requirement 6.5.4

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.1

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.8

[11] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Risky Resource Management - CWE ID 022

[12] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Risky Resource Management - CWE ID 426

[13] Standards Mapping - FIPS200 - (FISMA) SI