Weaknesses of type CWE-22

6,563 results

Traversal de diretório (path traversal)

A aplicação recebe um caminho de arquivo fornecido pelo usuário e o usa para acessar arquivos sem validar adequadamente se o resultado fica dentro do diretório permitido. Um atacante injeta sequências como '../' ou '..' para "escapar" do diretório esperado e acessar arquivos sensíveis do sistema.

Example

Um site permite download de arquivos do diretório /uploads passando o nome via URL: download.php?file=documento.pdf. Um atacante envia file=../../etc/passwd e consegue ler arquivos fora de /uploads, porque o código não neutraliza a sequência '..'.

How to mitigate

Valide e canonicalize todo caminho fornecido pelo usuário antes de usá-lo: implemente uma whitelist de nomes permitidos, normalize caminhos para sua forma canônica, verifique se o resultado está dentro do diretório esperado, e use APIs de segurança da linguagem (ex: Path.normalize() + validação de prefix em Java, pathlib em Python).

CVE-2017-16216—tencent-server is a simple web server. tencent-server is vulnerable to a directory traversal issue, giving an attacker access to the filesysEPSS 2.0%CVE-2017-16178—intsol-package is a file server. intsol-package is vulnerable to a directory traversal issue, giving an attacker access to the filesystem byEPSS 2.0%CVE-2017-16200—uv-tj-demo is a static file server. uv-tj-demo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by EPSS 2.0%CVE-2017-16164—desafio is a simple web server. desafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placingEPSS 2.0%CVE-2017-16083—node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker acEPSS 2.0%CVE-2017-16110—weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attackerEPSS 2.0%CVE-2017-16189—sly07 is an API for censoring text. sly07 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placiEPSS 2.0%CVE-2017-16036—`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giEPSS 2.0%CVE-2017-16092—Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to EPSS 2.0%CVE-2017-16175—ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pEPSS 2.0%CVE-2017-16142—infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16220—wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing EPSS 2.0%CVE-2017-16182—serverxxx is a static file server. serverxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16168—wffserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.EPSS 2.0%CVE-2017-16120—liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placEPSS 2.0%CVE-2017-16096—serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesyEPSS 2.0%CVE-2017-16124—node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker aEPSS 2.0%CVE-2017-16187—open-device creates a web interface for any device. open-device is vulnerable to a directory traversal issue, giving an attacker access to tEPSS 2.0%CVE-2017-16144—myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue, giving an attacker access to tEPSS 2.0%CVE-2017-15895—Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authentEPSS 2.0%