Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-36 Base Rascunho
Absolute Path Traversal
This vulnerability occurs when an application builds file paths using user input without properly blocking absolute paths like '/etc/passwd' or 'C:\Windows\system32'. Attackers can exploit this to…
Definição
What is CWE-36?
This vulnerability occurs when an application builds file paths using user input without properly blocking absolute paths like '/etc/passwd' or 'C:\Windows\system32'. Attackers can exploit this to escape the intended directory and access sensitive files anywhere on the server.
Absolute path traversal happens because the application trusts user-supplied input when constructing filesystem paths, failing to validate or sanitize sequences that point to root directories. Unlike relative path traversals (using '..'), this attack uses full paths starting from the filesystem root, allowing direct access to critical system files, configuration files, or application source code outside the webroot.
Preventing this requires validating all user input used in file operations, rejecting any path containing a leading slash or drive letter, and using canonicalization functions to resolve paths before checking if they remain within the allowed directory. While SAST tools can detect the vulnerable pattern, Plexicus uses AI to analyze the context and suggest the precise code fix—such as implementing an allowlist or path normalization—saving developers hours of manual security review and remediation.
Impacto no mundo real
Real-world CVEs caused by CWE-36
-
Product for managing datasets for AI model training and evaluation allows both relative (CWE-23) and absolute (CWE-36) path traversal to overwrite files via the Content-Disposition header
-
Python package constructs filenames using an unsafe os.path.join call on untrusted input, allowing absolute path traversal because os.path.join resets the pathname to an absolute path that is specified as part of the input.
-
Multiple FTP clients write arbitrary files via absolute paths in server responses
-
ZIP file extractor allows full path
-
Path traversal using absolute pathname
-
Path traversal using absolute pathname
-
Path traversal using absolute pathname
-
Arbitrary files may be overwritten via compressed attachments that specify absolute path names for the decompressed output.
Como os atacantes a exploram
Trajeto do atacante passo a passo
- 1
In the example below, the path to a dictionary file is read from a system property and used to initialize a File object.
- 2
However, the path is not validated or modified to prevent it from containing relative or absolute path sequences before creating the File object. This allows anyone who can control the system property to determine what file is used. Ideally, the path should be resolved relative to some kind of application or user home directory.
- 3
This script intends to read a user-supplied file from the current directory. The user inputs the relative path to the file and the script uses Python's os.path.join() function to combine the path to the current working directory with the provided path to the specified file. This results in an absolute path to the desired file. If the file does not exist when the script attempts to read it, an error is printed to the user.
- 4
However, if the user supplies an absolute path, the os.path.join() function will discard the path to the current working directory and use only the absolute path provided. For example, if the current working directory is /home/user/documents, but the user inputs /etc/passwd, os.path.join() will use only /etc/passwd, as it is considered an absolute path. In the above scenario, this would cause the script to access and read the /etc/passwd file.
- 5
The constructed path string uses os.sep to add the appropriate separation character for the given operating system (e.g. '\' or '/') and the call to os.path.normpath() removes any additional slashes that may have been entered - this may occur particularly when using a Windows path. The path is checked against an expected directory (/home/cwe/documents); otherwise, an attacker could provide relative path sequences like ".." to cause normpath() to generate paths that are outside the intended directory (CWE-23). By putting the pieces of the path string together in this fashion, the script avoids a call to os.path.join() and any potential issues that might arise if an absolute path is entered. With this version of the script, if the current working directory is /home/cwe/documents, and the user inputs /etc/passwd, the resulting path will be /home/cwe/documents/etc/passwd. The user is therefore contained within the current working directory as intended.
Exemplo de código vulnerável
Vulnerable Java
In the example below, the path to a dictionary file is read from a system property and used to initialize a File object.
String filename = System.getProperty("com.domain.application.dictionaryFile");
File dictionaryFile = new File(filename); Exemplo de código seguro
Secure Python
However, if the user supplies an absolute path, the os.path.join() function will discard the path to the current working directory and use only the absolute path provided. For example, if the current working directory is /home/user/documents, but the user inputs /etc/passwd, os.path.join() will use only /etc/passwd, as it is considered an absolute path. In the above scenario, this would cause the script to access and read the /etc/passwd file.
import os
import sys
def main():
filename = sys.argv[1]
path = os.path.normpath(f"{os.getcwd()}{os.sep}{filename}")
if path.startswith("/home/cwe/documents/"):
try:
with open(path, 'r') as f:
file_data = f.read()
except FileNotFoundError as e:
print("Error - file not found")
main() What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção
How to prevent CWE-36
- Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
- Implementation Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
- Operation Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Sinais de deteção
How to detect CWE-36
O Plexicus deteta automaticamente o CWE-36 e abre um PR de correção em menos de 60 segundos.
O Codex Remedium analisa cada commit, identifica esta fraqueza exata e entrega um pull request pronto para revisão com o patch. Sem tickets. Sem transferências.
Perguntas frequentes O que é o CWE-36?
Qual a gravidade do CWE-36?
Que linguagens ou plataformas são afetadas pelo CWE-36?
Como posso prevenir o CWE-36?
Como é que o Plexicus deteta e corrige o CWE-36?
Onde posso saber mais sobre o CWE-36?
Frequently asked questions
O que é o CWE-36?
This vulnerability occurs when an application builds file paths using user input without properly blocking absolute paths like '/etc/passwd' or 'C:\Windows\system32'. Attackers can exploit this to escape the intended directory and access sensitive files anywhere on the server.
Qual a gravidade do CWE-36?
A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.
Que linguagens ou plataformas são afetadas pelo CWE-36?
MITRE lists the following affected platforms: AI/ML.
Como posso prevenir o CWE-36?
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and…
Como é que o Plexicus deteta e corrige o CWE-36?
O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-36 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.
Onde posso saber mais sobre o CWE-36?
A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/36.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.
Fraquezas relacionadas
Weaknesses related to CWE-36
CWE-22 Pai
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
This vulnerability occurs when an application builds a file path using user input but fails to properly validate it, allowing an attacker…
CWE-23 Irmão
Relative Path Traversal
This vulnerability occurs when an application builds file paths using user-supplied input without properly validating or sanitizing it.…
CWE-37 Filho
Path Traversal: '/absolute/pathname/here'
This vulnerability occurs when an application accepts user input containing absolute file paths (starting with a forward slash like…
CWE-38 Filho
Path Traversal: '\absolute\pathname\here'
This vulnerability occurs when an application accepts user-supplied input containing Windows-style absolute paths (like…
CWE-39 Filho
Path Traversal: 'C:dirname'
This vulnerability occurs when an application accepts user input containing Windows drive letters (like 'C:dirname') without proper…
CWE-40 Filho
Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
This vulnerability occurs when an application accepts user input containing a Windows UNC share path (like '\\UNC\share\name') without…
Recursos
Further reading
- MITRE — CWE-36 oficial https://cwe.mitre.org/data/definitions/36.html
- Secure by Design Alert: Eliminating Directory Traversal Vulnerabilities in Software https://www.cisa.gov/resources-tools/resources/secure-design-alert-eliminating-directory-traversal-vulnerabilities-software
- D3FEND: Application Layer Firewall https://d3fend.mitre.org/dao/artifact/d3f:ApplicationLayerFirewall/
Pronto quando você estiver
Pare de pagar por desenvolvedor.
Comece a fechar o ciclo.
O Plexicus é o ASPM nativo de IA que verifica, filtra, corrige, pentesta e explica — de forma autónoma. Programadores ilimitados, repos ilimitados, ações de IA de utilização justa. Nível gratuito real, €269/mo anual quando estiver pronto.