1. Home
  2. CWE Database
  3. CWE-35
Variant · Low-Medium

CWE-35: Path Traversal: '.../...//'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can reso...

CWE-35 · Variant Level ·2 CVEs ·2 Mitigations

Description

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Potential Impact

Confidentiality, Integrity

Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism

Demonstrative Examples

Suppose the product serves files from a specific "public" directory -- /home/product/public/ -- and has an algorithm that attempts to protect against common path traversal attacks. The algorithm works by sequentially scanning through a requested filename and removes each occurrence of "../" that it encounters, then appending the filename to the public directory.
If an attacker provides this filename:
Attack
../secret.dat
then the code would correctly remove the "../" resulting in the name:
Result
/home/product/public/secret.dat
This request would fail, because secret.dat is not in /home/product/public/secret.dat.
The attacker could attempt to bypass this protection mechanism using this string:
Attack
.../...//secret.dat
The algorithm would remove the first occurrence of "../" to produce:
Result
....//secret.dat
The algorithm would then find and remove the second (and final) "../" sequence, producing:
Result
../secret.dat
At this point, the algorithm stops because it removed all "../" that appeared in the original string, but the algorithm has collapsed the original input into an unsafe value (CWE-182) that is still subject to path traversal.
The end result is:
Result
/home/product/public/../secret.dat
Which the OS resolves to /home/product/secret.dat, a file that is outside the public directory.
Good
The algorithm could be changed to use a built-in path canonicalization function that effectively removes "../" sequences, removes symbolic links, etc., such as realpath() in C. An alternate approach might be to run a loop that continues to remove "../" sequences from successive outputs until all suspect sequences are removed. However, relying solely on such a filter may be risky, since there may be sequences or characters that the filter is not covering for all environments.

Mitigations & Prevention

Implementation High

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across relat

Implementation

Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Detection Methods

  • Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

CVE IDDescription
CVE-2005-2169chain: ".../...//" bypasses protection mechanism using regexp's that remove "../" resulting in collapse into an unsafe value "../" (CWE-182) and resultant path traversal.
CVE-2005-0202".../....///" bypasses regexp's that remove "./" and "../"

CWE-23: Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not pr...

Taxonomy Mappings

  • PLOVER: — '.../...//'
  • Software Fault Patterns: SFP16 — Path Traversal

Frequently Asked Questions

What is CWE-35?

CWE-35 (Path Traversal: '.../...//') is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Variant-level weakness. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can reso...

How can CWE-35 be exploited?

Attackers can exploit CWE-35 (Path Traversal: '.../...//') to read files or directories, modify files or directories, bypass protection mechanism. This weakness is typically introduced during the Implementation phase of software development.

How do I prevent CWE-35?

Key mitigations include: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not stric

What is the severity of CWE-35?

CWE-35 is classified as a Variant-level weakness (Low-Medium abstraction). It has been observed in 2 real-world CVEs.