CME-1301
Path Traversal Prevention (Canonicalization)
Description
Application-level path validation that canonicalizes user-supplied paths (resolving symlinks, ../, and relative references) and verifies the resolved path falls within an allowed base directory. Rejects absolute path injection and directory traversal sequences before any filesystem operation. Prevents attackers from reading or writing files outside intended directories.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Traversal payloads (../, absolute paths) are rejected before reaching filesystem operations; attacker must find a bypass that survives full path canonicalization and prefix validation |
| Confidentiality (C) | H → L | File read confined to allowed directory; sensitive files outside base path are unreachable |
| Integrity (I) | H → L | File write operations confined to allowed directory; attacker cannot overwrite arbitrary system files outside the base path |
CWE Relationships
Verification
Test application with path traversal payloads and verify rejection; inspect source for canonicalization before file access
$ grep -rn 'os.path.realpath\|pathlib.*resolve\|os.path.abspath\|getCanonicalPath\|toRealPath\|path\.resolve\|realpathSync\|filepath\.EvalSymlinks\|filepath\.Abs\|Path\.GetFullPath' <app_source>/
# Expected: realpath|resolve|getCanonicalPath|GetFullPath|EvalSymlinks
# Expected: realpath|resolve|getCanonicalPath|GetFullPath|EvalSymlinks
Platform: any
$ grep -rn 'is_relative_to\|os.path.commonpath\|startsWith.*getCanonical\|path\.relative\|filepath\.Rel\|Path\.GetRelativePath' <app_source>/
# Expected: is_relative_to|commonpath|startsWith|relative|Rel
# Expected: is_relative_to|commonpath|startsWith|relative|Rel
Platform: any
$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/<endpoint>?path=../../etc/passwd'
# Expected: 400 or 403
# Expected: 400 or 403
Platform: any