Web servers generally are set up to restrict public access to a specific portion of the Web server's file system, typically called the "Web document root" directory. This directory contains the files intended for public access and any scripts necessary to provide Web application functionality. In a path traversal attack, an intruder manipulates a URL in such a way that the Web server executes or reveals the contents of a file anywhere on the server, including those lying outside the document root directory. Path traversal attacks take advantage of special-characters sequences in URL input parameters, cookies and HTTP request header.
The most basic path traversal attack uses the "../" character sequence to alter the document or resource location requested in a URL. Although most Web servers prevent this method from escaping the web document root, alternate encodings of the "../" sequence, such as Unicode-encoding, can bypass basic security filters. Even if a Web server properly restricts path traversal attempts in the URL path, any application that exposes an HTTP-based interface is also potentially vulnerable to such attacks. For example, look at the two URLs below:
Correct URL:
http://www.yourserver.com/scripts/database.cgi?report=quarter1.txt
 |
| MORE INFORMATION |
Learn how to secure your Web site in Web Security School with guest instructor Michael Cobb
Submit your Web security questions to Michael Cobb in our Ask the Expert feature
Visit our resource center for more tips and advice on preventing Web threats |
|
|
|
|
Attack URL:
http://www.yourserver.com/scripts/database.cgi?page=../scripts/ database.cgi%00txt
This attack URL forces the CGI application to reveal the source code of the database.cgi file because the file is interpreted as text instead of an executable script. The attacker uses the "../" special-character sequence to traverse one directory above the current directory and enter the /scripts directory. The "%00" sequence is used both to bypass a simple file extension check and to cut off the extension when the file is read and processed by the CGI application. This example highlights the critical importance of always checking and cleaning any user-supplied input before allowing it to be processed by a Web server or Web applications.
You should, of course, apply the most recent security patches to your system and monitor security announcements and patch releases for any applications that run on your Web server. For example, some versions of PHP contain a bug that enables an attacker to perform directory traversal by manipulating the file name of an uploaded file, so make sure you have the relevant patches applied.
Because traversal attacks allow an attacker to execute operating system programs and tools, you should always locate Web root directories and virtual directories on a non-system partition. It's not possible to traverse across drives. For example, if your system is installed on the C: drive, consider moving your site and content directory to the E: drive, ensuring that all virtual directories point to the new drive. For a Windows-based Web site this means never using the default \Inetpub\wwwroot directory for the location of Web site content. This tactic also ensures that any future canonicalization worm that allows an attacker to access system files will fail.
The easiest way to tighten an IIS Web server against this and other attacks is to download and run the IISLockdown tool, free from http://download.microsoft.com. URLScan, which is installed when you run IISLockdown, blocks requests that contain unsafe characters. IISLockdown also disables the parent paths setting, which prevents the use of ".." in script and application calls. Finally, IIS Web administrators should check all Web permissions, which provide an extra layer of security to NTFS file permissions, and consider upgrading to IIS 6.0, which provides significantly enhanced default security over previous versions of IIS.
About the author
Michael Cobb, CISSP-ISSAP, is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for SearchSecurity's Web Security School and, as a SearchSecurity.com site expert, answers user questions on application and platform security.
