Dev Training

# Dev Training
### Path Injection

## Overview

### About

* A type of injection vulnerability
* Known by many names
    * Path traversal
    * Directory traversal
    * Dot dot slash attack
    * Directory climbing

Notes:
* This one is a bit different.
    * Less direct than SQLi.
* Known by many names.
    * Subtle, overlapping differences.

## Path Traversal

### Image endpoint

```python
PATH = '/var/www/website/uploads/images/'

@app.route('/user-images/<string:image>')
def user_image(image):
    img_path = PATH + image
    return send_file(img_path)
```

Notes:
* We have an image endpoint.
    * Serves images.
    * Stored in this path.
* Straightforward approach.

### Intended use

```http
GET /user-image/cat.png HTTP/1.1
Host: www.example.com
```

```http
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 1337

😸
```

Notes:
* What is supposed to happen.

### What about...

```http
GET /user-image/../../../../../etc/passwd HTTP/1.1
Host: www.example.com
```

```python
# img_path = PATH + image
'/var/www/website/uploads/images/../../../../../etc/passwd'
```

```http
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 1337

root:x:0:0::/root:/bin/bash
bin:x:1:1::/:/sbin/nologin
daemon:x:2:2::/:/sbin/nologin
mail:x:8:12::/var/spool/mail:/sbin/nologin
ftp:x:14:11::/srv/ftp:/sbin/nologin
http:x:33:33::/srv/http:/sbin/nologin
```

Notes:
* But what happens if we do this?
* The path becomes this.
    * Resolves to /etc/passwd.
* File is returned.
* We have successfully traversed the directory tree.

## Local File Inclusion

### What is it

* User-controlled file is interpreted by server
    * Web server (e.g., PHP, ASPX, JSP)
    * Web framework (e.g., PHP)
* Path traversal often used to exploit
* Sometimes categorized as path traversal

Notes:
* User is able to influence file.
    * File is interpreted by server.
* Overlap with path traversal.

### Example

```http
POST /profile/image HTTP/1.1
Host: www.example.com
Content-Type: multipart/form-data; boundary=---yay
Content-Length: 124

---yay
Content-Disposition: form-data; name="file";
filename="../../src/a.php"

<?php
    system($_GET['cmd']);
?>

---yay--

```

Notes:
* Profile image upload.
    * Vulnerable to path traversal.
    * Allows arbitrary file type.
* Simple PHP web shell.
    * Gets cmd parameter.
    * Evaluates system command.

### Exploit execution

```http
GET /a.php?cmd=whoami HTTP/1.1
Host: www.example.com

```

```http
HTTP/1.1 200 OK

root
```

Notes:
* If inclusion was successful.
    * We can do this.
* Now we have RCE.
    * As root in this case.
    * We now own the system.

## Impact

### Data exfiltration

* Secrets
* Source code
* Logs
* User data

Notes:
* Attacker can extract sensitive information.
    * Enable further compromise.

### Other

* Remote code execution
* Altering application state

Notes:
* Attacker can affect server's running state.
    * RCE is the holy grail.
    * Escape the application.

## Mitigation

### Avoidance

* Inserting user supplied input into paths should be avoided at all cost
* Many applications can be rewritten to deliver same results in safer manner

Notes:
* If possible, avoid completely.
* ID-based approach, for example.
    * User input matched against whitelist.
    * Many other safe strategies.

### If needed

Apply input filtering **and** path normalization

Notes:
* Input filtering is not enough!
    * Can be used with normalization in a pinch.

### Input filtering

* Check user input against allowed list of characters
    * Keep list as limited as possible
    * Reject requests that contain illegal characters
        * **Don't substitute!**
* Input filtering alone should never be considered adequate protection

Notes:
* Use whitelist approach.
    * Keep list limited.
    * Don't fix illegal requests!
        * Just reject them.
* This is not enough by itself!

### Path normalization

* Apply path normalization to path after user input has been added
    * `~/test` → `/home/apache/test`
    * `./test` → `/var/www/test`
    * `../test` → `/var/test`

* Verify that the normalized path is a sub-path of a directory that the user is allowed to access

Notes:
* What is path normalization?
* Conversion to full, unabbreviated path.
* After normalization, we can validate.
    * Use whitelist approach

### File upload

* Whitelist file extensions
* Validate file type
    * Don't trust content type header
* Don't trust filename
    * Change filename
    * Limit length and filter or sanitize

Notes:
* Use whitelist approach.
    * Another recurring theme.
* Validate file type.
    * Use more than one method.
    * Use framework features where available.
* Don't use user-provided filename.
    * Generate your own if possible.
    * Otherwise, limit, filter and sanitize.

## Rules of thumb

### Path traversal

* Try to avoid user input in paths
* If it cannot be avoided
    * Apply input filtering
    * Apply path normalization
    * Verify that the path is pointing to the right place

Notes:
* Avoid user input in paths.
* If you absolutely can't.
    * Filtering, normalization and then validate!
    * Consult your framework's documentation.

### Local file inclusion

* Protect upload endpoints from path traversal
* Validate file type
* Isolate file storage, if possible
* Disable unused web server modules and harden

Notes:
* Apply same protections.
* Validate file type.
    * Use many strategies.
    * Built-in framework features where available.
* Isolate storage if possible.
* Use globally applicable security principles.

## Epilogue

### Further reading

* [OWASP - Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
* [OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html)
* [PortSwigger Academy - Directory Traversal](https://portswigger.net/web-security/file-path-traversal)

### Hall of fame

* [Apache HTTP Server Path Traversal](https://blog.qualys.com/vulnerabilities-threat-research/2021/10/27/apache-http-server-path-traversal-remote-code-execution-cve-2021-41773-cve-2021-42013)