Path Manipulation

ABSTRACT

通過用戶輸入控制 file system 操作所用的路徑，可以讓攻擊者有機會訪問或修改其他受保護的系統資源。

EXPLANATION

當滿足以下兩個條件時，就會產生 path manipulation 錯誤：

1. 攻擊者能夠指定某一 file system 操作中所使用的路徑。

2. 攻擊者可以通過指定特定資源來獲取某種權限，而這種權限在一般情況下是不可能獲得的。

例如，在某一程序中，攻擊者可以獲得特定的權限，以重寫指定的文件或是在其控制的配置環境下運行程序。

示例：下列代碼使用來自 HTML 表單的輸入來更新或刪除文件中的記錄。

...
EXEC CICS
WEB READ
FORMFIELD(FILE)
VALUE(FILENAME)
  ...
END-EXEC.

EXEC CICS
READ
FILE(FILENAME)
INTO(RECORD)
RIDFLD(ACCTNO)
UPDATE
  ...
END-EXEC.
...

REFERENCES

[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A1 Unvalidated Input

[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A4 Insecure Direct Object Reference

[3] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A4 Insecure Direct Object References

[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3510 CAT I, APP3600 CAT II

[5] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3510 CAT I, APP3600 CAT II

[6] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 22, CWE ID 73

[7] G. Hoglund, G. McGraw Exploiting Software Addison-Wesley

[8] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Path Traversal

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.3.1.1, Requirement 6.5.4

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.1

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.8

[12] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Risky Resource Management - CWE ID 022

[13] Standards Mapping - SANS Top 25 2011 - (SANS Top 25 2011) Risky Resource Management - CWE ID 022

[14] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Risky Resource Management - CWE ID 426

[15] Standards Mapping - FIPS200 - (FISMA) SI