01 — Vulnerability Overview: Path Traversal (CWE-22)

Quick Facts

Property	Value
CWE ID	CWE-22
Title	Improper Limitation of a Pathname to a Restricted Directory
Rank	#1 Most Common CWE (across all vulnerability categories)
Related CVEs	1,000+ across all platforms
Average CVSS	5.5 - 7.5 (medium-high)
Affected Systems	All systems with file access control
Discovery Timeline	1990s, still prevalent in 2024
Status	Remains in OWASP Top 10

The Problem

Path traversal (directory traversal) occurs when an application allows users to access files outside the intended directory.

Vulnerable Code Pattern:

# VULNERABLE - Python Flask
@app.route('/download/<filename>')
def download_file(filename):
    return send_file(f'/var/www/uploads/{filename}')

# Attack payload
# GET /download/../../etc/passwd
# Resolves to: /var/www/uploads/../../etc/passwd = /etc/passwd

Attack Examples

1. Read System Files

# Access sensitive system files
/download/../../etc/passwd        # Unix password file
/download/../../etc/shadow        # Unix password hashes
/download/../../windows/win.ini   # Windows config
/download/../../boot.ini          # Windows boot config

2. Read Application Files

# Access source code, configs
/download/../../.env              # Environment variables with secrets
/download/../../config.php        # Database credentials
/download/../../database.db       # SQLite database file

3. Write Files (Combined with Upload)

# Upload file, then access it with path traversal
# Upload: shell.php to /uploads/
# Access: /download/../../shell.php (execute code)

Scale & Impact

Rank: #1 most reported weakness across all CVE databases
Prevalence: Found in 25-30% of web applications tested
Related CVEs: 1,000+ including major breaches

Real-World Incidents

Incident	Year	Impact	Details
AWS S3 Misconfiguration	2019	Millions of records	Path traversal in S3 object access
Docker Hub	2020	User tokens exposed	Path traversal in container exports
Kubernetes API	2020	Cluster secrets	Directory traversal in pod logs
GitHub Enterprise	2018	Source code exposure	Path traversal in file access API

Why Path Traversal Persists

Despite being 30+ years old:

Developers assume user input is "just a filename"
Symlink attacks are invisible (file looks like in intended dir)
Unicode normalization tricks (e.g., %C0%AE = /)
Case-sensitivity varies by OS (allows bypassing filters)

KGCS Context

CWE-22 (Path Traversal)
  ├─ DEMONSTRATED_BY → CAPEC-107 (Command Line Interface)
  ├─ DEMONSTRATED_BY → CAPEC-126 (Path Traversal)
  ├─ DEMONSTRATED_BY → CAPEC-167 (Directory Indexing)
  └─ IMPLEMENTS → Multiple ATT&CK Techniques:
       - T1005 (Data from Local System)
       - T1083 (File and Directory Discovery)
       - T1040 (Network Sniffing) - Via log access

Graph Statistics

Root Weakness: CWE-22
Related CVEs: 1,000+
Attack Patterns: 4 (CAPEC-107, CAPEC-126, CAPEC-167, CAPEC-177)
Affected Platforms: Billions (any system with file access control)
Defensive Controls: 15+ (input validation, chroot, SELinux)

Detection Challenges

Why path traversal succeeds: - No special characters required (../ is legitimate filename syntax) - Unicode/UTF-8 encoding bypasses simple filters - Symlinks make attacks invisible - Many systems don't log file access attempts

Next: 02 Root Cause Analysis