Directory Traversal Attack

How Directory Traversal Attack Works

Every web application confines its file operations to a designated root directory — the document root for static assets, an upload folder for user content, or a template directory for views. Directory traversal breaks this confinement. When the application builds a file system path using unsanitized user input, the attacker injects sequences that climb the directory tree until reaching the system root, then descends into any target directory. The attack surface is enormous: any parameter, header, cookie, or multipart field that ultimately feeds into a file system API is a potential entry point.

Real-World Examples

Impact & Risk Assessment

Directory traversal is classified as Critical because it collapses the most fundamental security boundary in web applications: file system isolation. A successful attack yields immediate access to configuration files containing database credentials, API secrets, and encryption keys. On cloud-hosted workloads, it exposes instance metadata endpoints and service account tokens, enabling full cloud account takeover. When write access is achievable, the path to remote code execution is direct. Historical data from vulnerability disclosure programs shows that directory traversal consistently ranks among the top 5 most frequently reported vulnerability classes in bug bounty programs. The attack requires no authentication, no special tooling, and often bypasses perimeter defenses — making it accessible to low-skill attackers while remaining devastating in impact.

How to Detect Directory Traversal Attack

Deploy multi-layered detection: (1) WAF rules matching ../ and its encoded variants (%2e%2e, %252e%252e, %c0%ae%c0%ae, ....//), null bytes (%00), and references to known sensitive paths (/etc/passwd, /etc/shadow, /proc/self, win.ini, web.config); (2) Application-level logging of all file system operations with the resolved canonical path, alerting when any resolved path falls outside the expected base directory; (3) Runtime Application Self-Protection (RASP) intercepting file I/O system calls and blocking out-of-bounds access in real time; (4) Network-level IDS/IPS signatures for traversal patterns in HTTP traffic; (5) File integrity monitoring (AIDE, OSSEC) on critical system files to detect unauthorized reads via access-time changes. Correlate traversal attempts with the requesting IP's threat intelligence score to prioritize incident response.

How to Prevent Directory Traversal Attack

Adopt a defense-in-depth strategy: (1) Never construct file paths from user input — use an allowlist or indirect reference map (user submits an ID, server maps it to a pre-defined path); (2) If dynamic paths are unavoidable, resolve the canonical path (realpath() in C/PHP, Path.GetFullPath() in .NET, os.path.realpath() in Python, path.resolve() in Node.js) and verify it starts with the expected base directory using a strict prefix check; (3) Reject any input containing path separators (/, \), traversal sequences, null bytes, or URL-encoded variants — do this after decoding; (4) Use OS-level isolation: chroot jails, Linux namespaces, Docker containers with read-only root filesystems, or AppArmor/SELinux profiles restricting the process's file access; (5) Apply the principle of least privilege — the web server process should own and access only its document root; (6) Deploy a WAF with comprehensive traversal signatures, including encoded and Unicode variants; (7) On Windows IIS, disable short filename (8.3) generation to prevent PROGRA~1-style traversal.

Code Examples

const express = require('express');
const path = require('path');
const fs = require('fs');

const app = express();

// VULNERABLE: user input directly concatenated into file path
app.get('/files/:name', (req, res) => {
  const filePath = path.join(__dirname, 'uploads', req.params.name);
  // No validation — attacker uses: /files/..%2f..%2f..%2fetc%2fpasswd
  fs.readFile(filePath, (err, data) => {
    if (err) return res.status(404).send('Not found');
    res.send(data);
  });
});

// Attacker requests:
// GET /files/....//....//....//etc/passwd
// GET /files/%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
// GET /files/..%252f..%252f..%252fetc%252fpasswd  (double encoding)

const express = require('express');
const path = require('path');
const fs = require('fs');

const app = express();
const UPLOAD_DIR = path.resolve(__dirname, 'uploads');

app.get('/files/:name', (req, res) => {
  const fileName = req.params.name;

  // 1. Reject any path separators or traversal sequences
  if (/[\/\\]/.test(fileName) || fileName.includes('..')) {
    return res.status(400).json({ error: 'Invalid filename' });
  }

  // 2. Resolve the canonical (real) path
  const resolved = path.resolve(UPLOAD_DIR, fileName);

  // 3. Strict prefix check — must be inside UPLOAD_DIR
  if (!resolved.startsWith(UPLOAD_DIR + path.sep)) {
    return res.status(403).json({ error: 'Access denied' });
  }

  // 4. Verify file exists and is a regular file (not symlink to outside)
  fs.lstat(resolved, (err, stats) => {
    if (err || !stats.isFile()) {
      return res.status(404).json({ error: 'Not found' });
    }
    // 5. Check the real path of symlinks too
    const real = fs.realpathSync(resolved);
    if (!real.startsWith(UPLOAD_DIR + path.sep)) {
      return res.status(403).json({ error: 'Access denied' });
    }
    res.sendFile(real);
  });
});

package main

import (
	"net/http"
	"os"
	"path/filepath"
	"strings"
)

func safeFileHandler(baseDir string) http.HandlerFunc {
	absBase, _ := filepath.Abs(baseDir)

	return func(w http.ResponseWriter, r *http.Request) {
		// Clean the requested path
		reqPath := filepath.Clean(r.URL.Path)

		// Resolve the full path
		fullPath := filepath.Join(absBase, reqPath)
		absPath, err := filepath.Abs(fullPath)
		if err != nil {
			http.Error(w, "Invalid path", http.StatusBadRequest)
			return
		}

		// Verify the resolved path is within the base directory
		if !strings.HasPrefix(absPath, absBase+string(os.PathSeparator)) {
			http.Error(w, "Forbidden", http.StatusForbidden)
			return
		}

		// Resolve symlinks and re-check
		realPath, err := filepath.EvalSymlinks(absPath)
		if err != nil {
			http.Error(w, "Not found", http.StatusNotFound)
			return
		}
		if !strings.HasPrefix(realPath, absBase+string(os.PathSeparator)) {
			http.Error(w, "Forbidden", http.StatusForbidden)
			return
		}

		http.ServeFile(w, r, realPath)
	}
}

func main() {
	http.HandleFunc("/files/", safeFileHandler("./uploads"))
	http.ListenAndServe(":8080", nil)
}

Frequently Asked Questions

Related Attacks