Fallos del tipo CWE-22

5863 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2017-16145—sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystEPSS 2.0%CVE-2017-16123—welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16176—jansenstuffpleasework is a file server. jansenstuffpleasework is vulnerable to a directory traversal issue, giving an attacker access to theEPSS 2.0%CVE-2017-16214—peiserver is a static file server. peiserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16133—goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" EPSS 2.0%CVE-2017-16140—lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placiEPSS 2.0%CVE-2017-16159—caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue, giving an attacker access to the filesystem bEPSS 2.0%CVE-2017-16092—Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to EPSS 2.0%CVE-2017-16122—cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placingEPSS 2.0%CVE-2017-16175—ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pEPSS 2.0%CVE-2017-16095—serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the fileEPSS 2.0%CVE-2017-16164—desafio is a simple web server. desafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placingEPSS 2.0%CVE-2017-16130—exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attackeEPSS 2.0%CVE-2017-16217—fbr-client sends files through sockets via socket.io and webRTC. fbr-client is vulnerable to a directory traversal issue, giving an attackerEPSS 2.0%CVE-2017-16166—byucslabsix is an http server. byucslabsix is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placEPSS 2.0%CVE-2017-16221—yzt is a simple file server. yzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" EPSS 2.0%CVE-2017-16158—dcserver is a static file server. dcserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placEPSS 2.0%CVE-2017-16139—jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in EPSS 2.0%CVE-2017-16220—wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing EPSS 2.0%CVE-2017-16211—lessindex is a static file server. lessindex is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%