Path Traversal — CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Quick Navigation
- Difficulty Level: Beginner-Intermediate
- Time to Read: 20-30 minutes (all sections)
- Status: Complete (sections 1-7) + Placeholder (section 8)
Full Case Study Structure
| Section | Focus | Time |
|---|---|---|
| 01 Vulnerability Overview | Most prevalent CWE across systems | 5 min |
| 02 Root Cause Analysis | Path traversal fundamentals (~-~/, ..\, symlinks) | 8 min |
| 03 Attack Scenarios | CAPEC variants and real-world exploitation | 7 min |
| 04 Detection Coverage | Log analysis, WAF patterns, IDS signatures | 6 min |
| 05 Defense Playbook | Input validation, chroot jails, D3FEND | 8 min |
| 06 Reasoning Walkthrough | KGCS agent analysis for path traversal | 10 min |
| 07 Live Query Examples | Cypher queries for variant analysis | 8 min |
| 08 vs LLM Comparison | (Deferred) How KGCS differs | TBD |
Why This Case Study?
Path Traversal (CWE-22) demonstrates: - ✅ Prevalence: Single Most Reported CWE (across all categories) - ✅ Platform-Independence: Affects web apps, APIs, CLI tools, mobile apps - ✅ Multiple Vectors: Multiple CAPEC patterns (../, symlinks, unicode normalization) - ✅ Impact Range: File read → directory listing → code execution (when combined with file write)
KGCS Graph Stats
| Metric | Value |
|---|---|
| Root CWE | CWE-22 |
| Related CVEs | 1,000+ across all platforms |
| Attack Patterns | CAPEC-107, CAPEC-126, CAPEC-167, CAPEC-177 |
| ATT&CK Techniques | T1005, T1040, T1083, T1132 (information gathering & evasion) |
| Affected Platforms | Billions (any system with file access control) |
| Defensive Controls | 15+ (input validation, sandboxing, SELinux/AppArmor) |
Quick Attack Example
# Vulnerable web endpoint
GET /download?file=document.pdf
# Normal request
GET /download?file=document.pdf
# Returns: /var/www/files/document.pdf
# Attack payload (path traversal)
GET /download?file=../../etc/passwd
# Returns: /etc/passwd (system file!)
# Defense
# What the app should do:
# 1. Sanitize "../" before processing
# 2. Use canonical path (resolve symlinks)
# 3. Check if result is still within /var/www/files/
# 4. If not, reject request
Complete Case Study
Ready to dive in? Start with 01 Vulnerability Overview
Jump to specifics: - Defense-focused? → 05 Defense Playbook - Developer? → 06 Reasoning Walkthrough - Hands-on? → 07 Live Query Examples
This case study is complete. Sections [01-07] are ready to read.