CME-1301
Path Traversal Prevention (Canonicalization)
Description
Application-level path validation that canonicalizes user-supplied paths (resolving symlinks, ../, and relative references) and verifies the resolved path falls within an allowed base directory. Rejects absolute path injection and directory traversal sequences before any filesystem operation. Prevents attackers from reading or writing files outside intended directories.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Traversal payloads (../, absolute paths) are rejected before reaching filesystem operations; attacker must find a bypass that survives full path canonicalization and prefix validation |
| Confidentiality (C) | H → L | File read confined to allowed directory; sensitive files outside base path are unreachable |
| Integrity (I) | H → L | File write operations confined to allowed directory; attacker cannot overwrite arbitrary system files outside the base path |
CWE Relationships
Verification
Test application with path traversal payloads and verify rejection; inspect source for canonicalization before file access
$ grep -rn 'os.path.realpath\|pathlib.*resolve\|os.path.abspath\|getCanonicalPath\|toRealPath\|path\.resolve\|realpathSync\|filepath\.EvalSymlinks\|filepath\.Abs\|Path\.GetFullPath' <app_source>/
# Expected: realpath|resolve|getCanonicalPath|GetFullPath|EvalSymlinks
# Expected: realpath|resolve|getCanonicalPath|GetFullPath|EvalSymlinks
Platform: any
$ grep -rn 'is_relative_to\|os.path.commonpath\|startsWith.*getCanonical\|path\.relative\|filepath\.Rel\|Path\.GetRelativePath' <app_source>/
# Expected: is_relative_to|commonpath|startsWith|relative|Rel
# Expected: is_relative_to|commonpath|startsWith|relative|Rel
Platform: any
$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/<endpoint>?path=../../etc/passwd'
# Expected: 400 or 403
# Expected: 400 or 403
Platform: any
Remediation
linux
nginx location-based path traversal blocking
printf 'server {\n # Block path traversal sequences (decoded and encoded)\n location ~* "\.\.\/|\.\.\\\\|%%2e%%2e|%%252e" {\n return 403;\n }\n # Normalize URI before proxying — merge_slashes is on by default\n # Reject requests with null bytes\n if ($request_uri ~ "\\x00") {\n return 400;\n }\n}\n' > /etc/nginx/conf.d/cme-1301-traversal-block.conf
nginx -t
nginx -s reload
linux
Apache mod_rewrite path traversal rejection
printf '<IfModule mod_rewrite.c>\n RewriteEngine On\n # Block decoded traversal sequences\n RewriteCond %%{REQUEST_URI} \\.\\./ [OR]\n RewriteCond %%{REQUEST_URI} \\.\\.\\\\\\\\ [OR]\n # Block URL-encoded traversal (%%2e%%2e)\n RewriteCond %%{QUERY_STRING} (\\.|%%2e)(\\.|%%2e)(%%2f|%%5c|/|\\\\\\\\) [NC,OR]\n # Block null bytes\n RewriteCond %%{REQUEST_URI} %%00\n RewriteRule .* - [F,L]\n</IfModule>\n' > /etc/httpd/conf.d/cme-1301-traversal-block.conf
apachectl configtest
apachectl graceful