flawopen.com/Vulnerabilities/Path Traversal & Zip Slip

Path Traversal & Zip Slip

High Severity CWE-22 Modern Web & Cloud

ELI5 — The Elevator 'Door Open' Backstage Pass

Imagine you are in a public museum where visitors are only allowed on Floor 1. In the elevator, the buttons for Floors 2 and 3 are removed. But an attacker discovers that pressing 'Up, Down, Down, Up' confuses the elevator computer, taking them into the restricted basement evidence vault. In Path Traversal, an attacker feeds dot-dot-slash (../../) sequences into a file downloader or unzipper, breaking out of the intended folder and rewriting critical system configuration files.

Target: Filesystem directories, archive extraction (Zip Slip), file downloads

Vector: Dot-dot-slash (../, ..\), URL-encoded paths (%2e%2e%2f)

Impact: Arbitrary file reading (/etc/passwd), remote code execution via file overwrite

Remediation: Path canonicalization, boundary prefix checks, verifying archive member paths

The Mechanism & Root Cause

When an application concatenates user input directly into file paths (e.g. open('/data/' + filename)), path navigation tokens like ../ resolve relative to the root filesystem. In archive extraction (Zip Slip), malicious tar or zip archives contain relative filenames like ../../../../var/www/html/shell.php that overwrite webroots upon unzipping.

file_server.js (Vulnerable)Vulnerable

// VULNERABLE: Direct path concatenation and unvalidated zip extraction
const fs = require('fs');
const path = require('path');

app.get('/download', (req, res) => {
  // Attacker passes: ../../../../etc/passwd
  const filePath = path.join('/var/app/public/files', req.query.file);
  res.sendFile(filePath); // Exfiltrates arbitrary system files!
});

file_server.js (Hardened)Hardened

// HARDENED: Canonicalize path and assert it remains strictly within base directory
const fs = require('fs');
const path = require('path');

app.get('/download', (req, res) => {
  const BASE_DIR = path.resolve('/var/app/public/files');
  const safePath = path.resolve(BASE_DIR, req.query.file);

  // Ensure canonical path starts with base directory prefix
  if (!safePath.startsWith(BASE_DIR + path.sep)) {
    return res.status(403).send("Forbidden: Directory traversal attempt detected.");
  }

  res.sendFile(safePath);
});

The Attack & Exploit Sequence

1Attacker discovers a file download endpoint taking a file=report.pdf query parameter.:
2Attacker replaces the parameter with file=../../../../etc/shadow or ..%2f..%2f.env.:
3The runtime resolves the relative path to the root partition and leaks private database passwords and secret API keys.:
4Alternatively, an attacker uploads a Zip Slip archive where payload files extract directly into system crontabs, achieving automated root execution.:

Defensive Engineering & Prevention Rules

✓Always Canonicalize with Realpath: Convert paths using path.resolve() or os.path.realpath() before opening files to strip all relative traversal tokens.
✓Verify Safe Prefix Bounds: Check that canonical_path.startswith(safe_base_directory) before reading or writing any file on disk.
✓Sanitize Archive Extraction Targets: When unpacking zip/tar archives, inspect each member entry's destination name and reject any entry attempting to write outside the extraction folder.
✓Store Files by UUID in Database: Decouple user-visible filenames from storage paths on disk by saving uploads as random UUIDs in isolated object storage (e.g. S3).

Explore related security topics and post-mortems: Complete Security Directory →