ITPEC FE Morning April 2019 Question 37

Specifying a file by its path name to view a file the administrator never meant to expose — directory traversal escapes the intended directory through the path.

A web application that builds a file path from user input, for example a fixed directory plus a file name parameter, is vulnerable if it does not check that input. The attacker sends ../../etc/passwd; each ../ climbs one directory, and the server reads a file outside the public directory. Defences are to reject path separators and .. in the input, map the input to a fixed list of files, and check the resolved path before opening it.

Answer (d)

Why not others:

• •(a) — entering database commands as input so that unintended SQL runs is SQL injection
• •(b) — exploiting missing escaping of HTML output to run a script in the user's browser is cross-site scripting (XSS)
• •(c) — obtaining a logged-in user's session ID and impersonating that user is session hijacking

Key rule: Name an input attack by what the unchecked input turns into: an SQL statement is SQL injection, a script in the page is XSS, and a file path is directory traversal.

Security · AI-written, may contain errors