|
|
|||
| Rule General Information |
|---|
| Release Date: | 2022-08-21 | |
| Rule Name: | Directory Traversal Detection | |
| Severity: | ||
| CVE ID: | ||
| Rule Protection Details |
|---|
| Description: | The directory traversal vulnerability exploits the lack of validation of operating system relative path jump characters (such as ../) in some web applications, Cause directory traversal which may result in arbitrary file access or arbitrary file upload.This rule is used to detect suspicious directory traversal symbols in HTTP requests. | |
| Impact: | Through directory traversal attacks, an attacker can cause directory traversal, which may lead to any file access or upload. | |
| Affected OS: | Windows, Linux, Others | |
| Reference: | https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d https://cxsecurity.com/cveshow/CVE-2022-1993/ |
|
| Solutions |
|---|
| 1. Filter or escape the path entered by the user to ensure that the input does not contain special characters or path separators. 2. Standardize the file path entered by the user to ensure that the path conforms to the expected format and structure. 3. ensure that the file system permissions of Web servers and applications are set properly, and restrict access to sensitive files and directories. |