CWEweakness

CWE-57 Path Equivalence: 'fakedir/../realdir/filename'

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

Common consequences

• Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

Potential mitigations

• [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Observed examples

• CVE-2001-1152: Proxy allows remote attackers to bypass denylist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters. • CVE-2000-0191: application check access for restricted URL before canonicalization • CVE-2005-1366: CGI source disclosure using "dirname/../cgi-bin"

Related

Observed example · CVE (3)

  • CVE-2005-1366 Pico Server (pServ) 3.2 and earlier allows remote attackers to obtain the source code for CGI scripts via "dirname/../cgi-bin" in a URL. vulnerability
  • CVE-2001-1152 Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and… vulnerability
  • CVE-2000-0191 Axis StorPoint CD allows remote attackers to access administrator URLs without authentication via a .. vulnerability

Child of · CWE (1)

  • CWE-41 Improper Resolution of Path Equivalence weakness

Referenced by CVE · weakness (1)

  • CVE-2024-34995 svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under… vulnerability