Fallos del tipo CWE-22

6629 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2017-16140—lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placiEPSS 2.0%CVE-2017-16189—sly07 is an API for censoring text. sly07 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placiEPSS 2.0%CVE-2017-16125—rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulEPSS 2.0%CVE-2017-16155—fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, EPSS 2.0%CVE-2017-16131—unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pEPSS 2.0%CVE-2017-16123—welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16216—tencent-server is a simple web server. tencent-server is vulnerable to a directory traversal issue, giving an attacker access to the filesysEPSS 2.0%CVE-2017-16165—calmquist.static-server is a static file server. calmquist.static-server is vulnerable to a directory traversal issue, giving an attacker acEPSS 2.0%CVE-2017-16156—myprolyz is a static file server. myprolyz is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placEPSS 2.0%CVE-2017-16104—citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the urlEPSS 2.0%CVE-2017-16154—earlybird is a web server module for early development. earlybird is vulnerable to a directory traversal issue, giving an attacker access toEPSS 2.0%CVE-2017-16159—caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue, giving an attacker access to the filesystem bEPSS 2.0%CVE-2017-16161—shenliru is a simple file server. shenliru is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placEPSS 2.0%CVE-2017-16196—quickserver is a simple static file server. quickserver is vulnerable to a directory traversal issue, giving an attacker access to the filesEPSS 2.0%CVE-2017-16218—dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem bEPSS 2.0%CVE-2017-16132—simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker accesEPSS 2.0%CVE-2017-16223—nodeaaaaa is a static file server. nodeaaaaa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16209—enserver is a simple web server. enserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placiEPSS 2.0%CVE-2017-16130—exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attackeEPSS 2.0%CVE-2017-16121—datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, givingEPSS 2.0%